Forms

A Canvas form is built once as a Form record and placed anywhere with a block, so one change to the form reaches every page carrying it. The fields are designed in the block editor like any other layout, and everything that happens after the visitor presses submit, the emails, the stored entry, the confirmation, the spam defences, lives in a tabbed Form Settings box on the same screen. Read this page when you are building a form or deciding what should happen to its submissions.

How To Build A Form

Starting screenFormsAdd New.

Give the form a title, then build its layout in the editor from the Canvas Forms blocks: a Form block holding Form Field blocks for each input and a Form Submit Button. Because the layout is ordinary blocks, columns, groups and headings work inside a form exactly as they do on a page.

Set a field's Autofill Purpose when it collects something the visitor has saved before, such as name, email or tel, because the browser can then offer to fill it and assistive technology can name what it is for. Leave it empty on a field with no such purpose. On a multi-line field, set Rows to 0 when your stylesheet sizes the box, so no line count is forced on it. The submit button's icon takes one-off declarations in Icon Inline Style, for a design that spaces the icon from its label by a value no utility class carries.

When the layout is done, place the form where it should appear: open the target page, insert the Form Embed block from the Canvas Forms category, and choose the form in its Form setting. When the page carries more than one form, fill in Form Accessible Name on each embed as well, such as Newsletter or Contact us, because a screen reader otherwise announces every one of them as the same unnamed form.

The Form Settings Tabs

Below the editor on the form's own screen sits the Form Settings box, with eight tabs. Work through them left to right:

General sets the Form Type: Standard Form, Login Form, Registration Form, Lost Password Form or Search Form. The authentication types hand the submission to WordPress login and registration instead of the standard actions, mapping fields by their names, and a Search Form stores nothing: it sends its fields as query arguments to the Results Page you choose.
Actions decides what runs on submit. Tick any of Send Email Notification, Save to Database, Send Webhook, Subscribe to Mailchimp and Trigger Side Panel. Ticking Trigger Side Panel reveals Side Panel ID, the panel opened after submission.
Notifications holds the emails, covered in Form Submissions And Notifications.
Webhook posts the submission to an external service: the Webhook URL, its Method and Request Format, the Payload Shape, and Custom Headers written one per line. Choose the flat payload shape for third-party form and email services, which usually expect each field at the top level, and the Canvas envelope for your own integrations, which keeps the submission wrapped with its form and request details.
Submission sets what the visitor sees on success: On Success switches between showing the Success Message and sending the visitor to the Redirect URL, and Clear form fields after successful submission resets the inputs.
Access restricts who can submit through Who Can Submit, with Allowed Roles for the role-restricted choice, and can cap repeat entries with Submission Limit Per User.
Spam stacks the defences: the invisible honeypot trap, reCAPTCHA v3, Cloudflare Turnstile, and a per-IP Rate Limit in seconds. The two challenge services need their keys entered under Canvas > Theme Options, in the Forms tab, before their toggles do anything.
Privacy controls how long stored entries are kept. Submission Retention (months) left empty follows the site default from Theme Options, 0 keeps entries forever, and Retention Action decides whether expired entries are permanently deleted or anonymized.

Site Defaults For Every Form

The Forms tab of Canvas > Theme Options carries defaults that fill in whatever a form leaves empty: the default notification recipient, the default success message, the honeypot default for new forms, file upload limits, and the SMTP settings that decide how notification email is actually sent. A site-wide endpoint URL can also be set there, and any form that defines no webhook of its own inherits it, with the webhook action switched on for it automatically, so one integration can receive every form on the site.

Pitfalls

A setting seems to be missing from a tab. Several controls appear only when their parent choice reveals them: Results Page appears for the Search type, the registration settings for the Registration type, and Side Panel ID once Trigger Side Panel is ticked. Change the parent setting first.

reCAPTCHA or Turnstile is on but no challenge runs. Both toggles require their site and secret keys under Theme Options in the Forms tab. Without keys the toggle has nothing to load.

Entries disappear after a while. Retention is doing its job. An empty Submission Retention follows the site default, so check both the form's Privacy tab and the Forms tab of Theme Options before assuming loss. Set the form's own value to 0 to keep its entries forever.

No entry is stored at all. Save to Database must be ticked under Actions. A form with only the email action sends mail and stores nothing.

Every Setting

The list below is generated from the product, so it is current by construction:

Form Type

Auth form types use WordPress authentication instead of standard actions. Design the form layout in the block editor, then the handler auto-maps fields by name (username, password, email, user_login). A Search Form stores nothing: it submits its fields as query arguments to the results page below.
Results Page

Where the search is sent. The page shows the results; its listing block reads the same field names as query arguments.

Shown when Form Type is "search".
Redirect After Auth

URL to redirect to after successful login/registration. Leave empty for home page.

Shown when Form Type is "login" or "register".
Auto-login after registration

Shown when Form Type is "register".
Default User Role

Shown when Form Type is "register".
Send Email Notification
Save to Database
Send Webhook
Subscribe to Mailchimp
Trigger Side Panel
Side Panel ID

Post ID of the Side Panel to trigger after submission.

Shown when Trigger Side Panel is "1".
Notification Name
Send To

Supports merge tags, e.g. {field:email}. Separate multiple addresses with commas.
From Email
From Name
Reply-To
CC

Comma-separated email addresses.
BCC

Comma-separated email addresses.
Subject
Message Body
Email Format
Attach uploaded files to this notification
Enable conditional sending
Notification Name
Send To

Supports merge tags, e.g. {field:email}. Separate multiple addresses with commas.
From Email
From Name
Reply-To
CC

Comma-separated email addresses.
BCC

Comma-separated email addresses.
Subject
Message Body
Email Format
Attach uploaded files to this notification
Enable conditional sending
Webhook URL
Method
Request Format
Payload Shape

Third-party form and email services usually expect each field at the top level. The envelope keeps the submission wrapped with its form and request details, which suits your own integrations.
Custom Headers

One header per line, e.g. Authorization: Bearer token123
On Success
Success Message

Displayed after a successful submission. HTML allowed.
Redirect URL

Used when "Redirect to URL" is selected above.
Clear form fields after successful submission
Who Can Submit
Allowed Roles

Only used when "Specific Roles" is selected above.
Access Denied Message
Submission Limit Per User

0 = unlimited.
Limit Reached Message
Enable honeypot field (invisible spam trap)

On by default for new forms (Theme Options → Forms → Spam).
Enable reCAPTCHA v3 (requires keys in Theme Options → Forms → Spam)
Enable Cloudflare Turnstile (requires keys in Theme Options → Forms → Spam)
Rate Limit (seconds)

Minimum seconds between submissions from the same IP. 0 = disabled.
Submission Retention (months)

0 = keep forever. Entries older than this will be processed by the retention action below. Leave empty to follow the site default (0 months).
Retention Action

Action to apply to entries older than the retention period.