Gravity Forms

Promptfree, for everyone, and the only version there is

Copy the prompt for Claude CodeCopy the prompt for CodexCopy the prompt for Cursor

Copy

Build me the form handling I actually need instead of a WordPress form plugin.

The honest framing: **if the site is WordPress, this is cheap and the ecosystem is the reason to keep it.** Build your own when the forms are the important part of the site, or when you are leaving WordPress anyway.

STACK
- Node 20+ with Fastify, server-rendered HTML with a little vanilla JS
- SQLite through better-sqlite3, WAL mode
- Caddy in front

THE DATA MODEL
- forms: id, slug, schema_json, version, notify_json, is_open
- entries: id, form_id, form_version, values_json, ip_hash, created_at, status
- files, payments, notifications as separate tables

WHAT TO BRING ACROSS
- Conditional logic, calculated fields, multi-page forms with progress, and file uploads. That is what people actually use out of a large plugin
- Server-side evaluation of every rule and every calculation, with the browser copy for convenience only
- The form version stored on each entry, so editing a form does not orphan its history

EMBEDDING IT IN AN EXISTING SITE
- Render the form as an HTML fragment from your service and include it, or post to your endpoint from a form in the existing page
- **The cross-origin case is the one to get right**: an explicit allow-list of origins, and a token in the form that the endpoint verifies. An open form endpoint is a spam relay within a week

SPAM, IN ORDER
- Honeypot, minimum fill time, per-IP-hash rate limit, then a hold-for-review score. A CAPTCHA only if all of that fails
- Every rejected submission stored with its reason rather than discarded, so a false positive is recoverable. **A spam filter with no record is a filter you cannot debug when it eats a real enquiry**

NOTIFICATIONS AND INTEGRATIONS
- Email from your own domain with SPF, DKIM and DMARC, reply-to set to the submitter, and a copy to them
- Outgoing webhooks with retries, a signature, and a dead-letter list — this replaces most of what an add-on ecosystem does
- Everything queued, so a slow third party cannot slow the submission

MIGRATING AWAY FROM THE PLUGIN
- Export existing entries first and check that the values survive the export, especially repeating fields and uploads
- Keep the old form live and redirect gradually rather than switching in one step

WHAT MATTERS MOST
The origin allow-list and keeping rejected submissions. One stops your endpoint being abused; the other stops your filter losing real enquiries silently.