Overview and requirements
MevvForms Free is the local runtime. A published form is read from a versioned WordPress form record, rendered with real labels and error relationships, validated again on the server, stored locally and handed to a durable notification queue.
- WordPress
- 6.6 or newer; tested through WordPress 7.1.
- PHP
- 8.1 or newer; the release matrix covers PHP 8.1–8.5.
- Data boundary
- Form definitions, entries and queued jobs remain on the WordPress site by default.
- Languages
- Editable PO, compiled MO and POT catalogues are included for Turkish and English.
Free makes no licence, telemetry, AI or update request to an external service while a visitor renders or submits a form.
Installation
- Take a restorable database and wp-content backup.
- Upload and activate the MevvForms Free ZIP.
- Confirm that the MevvForms database tables were created and that an administrator can open the dashboard.
- Keep the source form plugin active until migration preview, import and health checks are complete.
- Install the matching Pro companion only when the saved form uses a released Pro module.
Do not remove the Free package while Pro is installed. The saved form runtime belongs to Free; Pro extends it.
Rendering and submitting a form
Embed a published form with [mevvforms id="123"]. The renderer prints stable field identifiers, real labels, descriptions, an error summary target and a signed session tied to the current form revision.
- Required state and validation rules are taken from the server-owned schema.
- Hidden or unknown client values cannot relax server rules.
- A valid submission creates the entry before any notification side effect runs.
- The response contains the configured message or safe redirect, never the stored field values.
If a form changed after the page was opened, refresh the page before submitting so the signed session matches the current revision.
Reversible WPForms migration
Migration starts read-only. Preview lists mapped fields, notifications, confirmations, embeds and unsupported settings. Apply creates or updates one staged MevvForms form and records the source hash. It does not delete WPForms data, revisions, tables or page content.
- Require an exact preview before applying.
- Import the form as staged and compare source hashes again.
- Run the cutover health gate: publish, render, signed test submission, local entry and queued notification.
- Only after those checks pass may the source plugin be switched off.
- If any check fails, rollback restores the former active-plugin list and returns the imported form to draft.
The measured mevvshop.com inventory is one source form with 4 fields, 1 notification, 1 confirmation and one live embed. Those counts are a release gate for that site, not a promise about every WPForms form.
Entries and privacy boundary
Entries and typed field projections are stored in dedicated local tables. Passwords, card data, CVV, WordPress nonces, session tokens and fields marked store=false are never written to entry values.
- IP addresses are represented only by a site-specific HMAC where rate limiting needs it.
- Text, numeric and date projections support later search without changing the original field identity.
- A failed entry or outbox write rolls the complete submission transaction back.
- Production evidence records only form, entry and job identifiers; it never records submitted values.
Notifications and confirmations
Notifications are durable jobs. A mail outage cannot erase an accepted entry: transient failures retry with bounded delays, while permanent configuration errors stop for administrator action.
- Headers
- Recipients and header merge tags are validated; CR/LF injection is stripped.
- Body
- HTML is escaped or filtered for its output context.
- Confirmation
- Message, same-site page and allowlisted redirect decisions are selected from the saved schema.
- Idempotency
- The same notification job key cannot create the same side effect twice.
Free and Pro boundary
Free owns the dependable runtime: schema, base fields, accessible render, server validation, local entries, outbox notifications, confirmations, bilingual administration and reversible WPForms migration.
Pro is the companion for advanced released modules. Conditional workflows, multi-step conversion tools, documents, commerce, integrations, analytics and developer surfaces are enabled only as their release gates close. Saved Pro configuration must continue rendering and submitting while the installed Pro code remains available, even if its licence later expires.
A roadmap item is not advertised as a working capability. Check the installed version and release notes before designing a form around a Pro module.
Troubleshooting and rollback
- The legacy shortcode is blank
- Confirm that the source ID has an active migration mapping and that another plugin does not own the wpforms shortcode.
- Submission reports an expired session
- Reload the page and submit against the latest published revision.
- A notification is waiting
- Open the queue status, correct the permanent configuration error or allow the scheduled retry for a transient transport error.
- Cutover did not deactivate WPForms
- Read the health result. The safety gate kept or restored WPForms because render, submit, entry or job verification failed.
For support, share the plugin, WordPress and PHP versions plus the safe error code. Remove field values, customer data, session tokens, nonces and licence keys before sending logs.