Notifal Forms are HTML-first. You design fields, steps, validation, and success messaging in the template HTML (HTML Builder or AI). A Form CPT stores submission identity, emails, and secrets such as webhook URLs and Mailchimp API keys.
Available from Notifal 3.0.0.
What lives where
| In template HTML | In Form CPT / Settings |
|---|---|
| Steps, fields, labels, options | Form title for admin list |
| Required, unique, regex, conditionals | Admin / visitor confirmation emails |
| Multi-step, success message / redirect / behavior | Webhook and Mailchimp secrets |
data-form-id link to CPT | Captcha keys, rate limit, spam protection, module on/off |
Field structure can be edited under Notifal → Forms or on the canvas in the HTML Builder. Both paths stay synced. Visual design (spacing, colors, step layout) is edited only when the form widget is used inside a template.
Quick start
- Ask Noti in the HTML Builder for a lead form, or create a Form under Notifal → Forms (one form on Free; more with Pro).
- If you used Noti, the builder creates the Form CPT and sets
data-form-idfor you. Otherwise insert the Form widget and use Create & connect or pick an existing Form. - Configure emails and integrations on the Form edit screen.
- Optionally enable captcha under Settings → Forms.
When you ask Noti for a multi-step form, it builds steps and navigation in the template. You do not need to assemble that markup by hand.
Submit security (high level)
Submissions are checked on the server before anything is stored. That includes spam protections, optional captcha, field rules, and unique-value checks when enabled. Secrets never live in template HTML.
After a valid submit, Notifal stores the submission, sends emails, and runs integrations.
Unique field values
Turn on Require unique value for newsletter-style fields (for example email) so the same value cannot be submitted twice for that form.
- Forms admin: Fields → Advanced rules → Require unique value
- HTML Builder field panel: same toggle (
data-unique="true") - Comparison is case-insensitive against stored submission values
Security notes
- Never put API keys, webhook URLs, or Mailchimp secrets in HTML attributes.
- Submissions are validated on the server before storage.
- Visitor IP is stored as a hash only.
- Same-site redirects only for success redirects.