Works with your stack
Cookie consent for Forminator
one setting to check
Forminator loads reCAPTCHA, hCaptcha or Turnstile only on pages that show a form using it. When the captcha waits for consent, each Forminator form gets a short request at its top, and the visitor keeps what they typed. One Forminator option changes that: loading the form with AJAX.
By WPMU DEV · wpmudev.com · WordPress.org
Is this your product? Tell us if anything here is out of date. Write to us
Forminator
WordPress plugin
- Tested version
- 1.58.4
- How
- Tested automatically around each Cookie Rocks version
- Last test
- 7 November 2026
- Latest version
- 1.58.4 tested
- Active installs
- 600,000+
What Forminator adds to your visitors’ browser
No trackers In our test of Forminator 1.58.4 on 7 November 2026, the plugin itself added no tracker and no cookie. What you place in your pages with it, such as a video or a map, still counts.
What Forminator puts on your pages
- The form
- Its scripts and styles, served by your site.
- A captcha, if you add one
- Google reCAPTCHA, hCaptcha or Cloudflare Turnstile, loaded only on pages with a form that uses it.
- Custom fonts
- When a form’s style picks its own font, Forminator loads it from Bunny Fonts.
- Polls
- Polls that limit votes per browser set a first-party cookie after the vote.
- Payments
- Stripe and PayPal fields load their own scripts, and Stripe payments set a short first-party cookie.
What matters for consent with Forminator
No token, no entry
Without a captcha token, Forminator refuses the entry with an error on the form. Cookie Rocks stops the submit first and points to the request, so the visitor knows why.
The request sits on each form
Each Forminator form gets a note at its top, with a button that allows its captcha alone. The page reloads and the fields come back, except passwords, files and hidden fields.
Test forms loaded with AJAX
With Load form using AJAX, Forminator adds the form and its captcha script after the page has loaded. Test those forms with your banner on, or turn the option off on forms that use reCAPTCHA or hCaptcha.
Cache without AJAX
To keep form pages fresh, prefer Forminator’s option that prevents page caching on form pages. It keeps the form in the page, where its captcha can wait for consent.
Fonts from Bunny Fonts
Bunny Fonts sets no cookie, but the visitor’s IP address reaches it. Cookie Rocks never holds fonts and names Bunny Fonts in your cookie policy. See fonts.
Cookie Rocks with Forminator
- When reCAPTCHA or hCaptcha waits for consent, shows an “Allow” request at the top of its forms.
- Holds sending until reCAPTCHA is allowed, and puts back what the visitor typed after the page reloads.
What our tests found on Forminator
Good to knowCookie Rocks lists Wordfence, Forminator, WP WhatsApp and WPForms Pro cookies
- Each appears in its cookie list with its purpose.
- Wordfence: wfCBLBypass, wf_loginalerted_*, wfls-remembered-*.
- Forminator: poll-cookie-*, forminator_stripe_payment_owner.
- WP WhatsApp: nta-wa-gdpr. WPForms Pro: _wpfuuid.
Read in its code, 18 October 2026.
Full detail
Cookie Rocks lists the site cookies of Wordfence (wfCBLBypass, wf_loginalerted_*, wfls-remembered-*), Forminator (poll-cookie-*, forminator_stripe_payment_owner), WP WhatsApp (nta-wa-gdpr) and WPForms Pro (_wpfuuid) in the cookie list it writes, with their purpose.
Good to know · Contact Form 7, WPForms Lite, Forminator, Fluent Forms, Ninja FormsFive form plugins set nothing on a default home page
by default: Default settings
With default settings and no form on the page, Contact Form 7, WPForms Lite, Forminator, Fluent Forms and Ninja Forms set no cookie, store nothing and load no known third-party tool.
Seen in our tests, 17 October 2026, Contact Form 7, WPForms Lite, Forminator, Fluent Forms, Ninja Forms 6.2.2, 2.0.2.2, 1.58.2, 6.2.16, 3.15.6.
Full detail
On a fresh WordPress home page with default settings, Contact Form 7, WPForms Lite, Forminator, Fluent Forms and Ninja Forms set no cookie, keep nothing in the browser's storage and load no known third-party tool, before or after Accept all (no form or captcha placed on the page).
Depends on a setting · ForminatorWith Forminator's AJAX loading, a banner cannot see the form's captcha
setting “Load form using AJAX”
The form arrives after the page loads and adds its captcha itself, so a consent banner cannot hold that captcha or show a notice in the form.
What to do: Turn the option off on forms that use reCAPTCHA or hCaptcha.
Read in its code, 16 October 2026, Forminator 1.58.2.
Full detail
With Forminator's Load form using AJAX option, the form arrives after page load and front.loader.js creates its captcha script tags in the DOM, so a hold that rewrites the page HTML does not see the captcha and cannot place a notice in the form. In that mode the form is initialised only after all its scripts have loaded.
Set before the choice · ForminatorForminator loads its captcha only on pages with a form that uses it
reCAPTCHA comes from www.google.com, hCaptcha from js.hcaptcha.com, Turnstile from challenges.cloudflare.com. Without the captcha, the form is refused and nothing is saved or sent.
Read in its code, 16 October 2026, Forminator 1.58.2.
Full detail
Forminator loads its captcha only on pages that show a form using it: reCAPTCHA from www.google.com/recaptcha/api.js?render=explicit (no filter to switch to recaptcha.net), hCaptcha from js.hcaptcha.com, Turnstile from challenges.cloudflare.com. Without a token the server refuses the submission with an error on the captcha field (filter forminator_invalid_captcha_message); nothing is saved or sent.
Good to know · ForminatorForminator sets cookies only after a vote or a Stripe payment
- poll-cookie-<md5> after a vote, when the poll limits votes by browser (1 year by default).
- forminator_stripe_payment_owner (1 day) when a Stripe payment is prepared.
- Custom form fonts come from fonts.bunny.net, not Google Fonts.
Read in its code, 16 October 2026, Forminator 1.58.2.
Full detail
Forminator sets cookies only after an action: poll-cookie-<md5> after a vote when the poll limits votes by browser (HttpOnly, 1 year by default or the vote limit period) and forminator_stripe_payment_owner (1 day) when a Stripe payment is prepared; quizzes keep answers in sessionStorage during Stripe Checkout. Custom form fonts come from fonts.bunny.net, not Google Fonts. Prevent page caching on form pages defines DONOTCACHEPAGE.
Good to know · ForminatorCookie Rocks shows its reCAPTCHA request above Forminator forms
Cookie Rocks shows its reCAPTCHA permission request above Forminator forms too, where reCAPTCHA is held until consent.
Read in its code, 16 October 2026, Forminator 1.58.2.
How we test it
Around each version, with its latest release
Around each Cookie Rocks version, a fresh WordPress installs its latest version from WordPress.org next to Cookie Rocks and runs the same checks. A new version joins the next run on its own.
- Forminator 1.58.4, tested on 7 November 2026.
- The banner shows, the trackers of the test page wait for consent and load after it, and Cookie Rocks raises no PHP error.
- Settings of the test: Default settings after activation.
- Last run: Forminator 1.58.4 on 7 November 2026, with WordPress 7.1.3.
Forms and captchas
Other plugins of the same kind.
Questions
Does it cover polls and quizzes?
The request is added to Forminator forms. Polls and quizzes have not been tested.
What if I treat reCAPTCHA as necessary?
It then loads for everyone and no request is shown. The free Audit reminds you that authorities disagree on that exemption.
Does Forminator read WP Consent API?
No. Its Consent field is a checkbox in the form, not a cookie choice.
What happens after the 30-day trial?
The banner, your visitors’ choices and your proofs of consent keep working. Without a key, most settings lock, updates and support stop. Take a key at any time and everything opens again.
For Forminator sites
Forms that ask before they need a captcha.
check the ajax option
Every feature of the complete plugin for 30 days, no card. Forminator keeps working as it does today.
- During the trial: everything, including the full settings and the scans
- After 30 days without a key: the banner, your visitors’ choices and your proofs of consent keep working
- What waits for a key: most settings, updates and support
Get your trial key
Your e-mail and your site. Your key arrives as soon as you confirm your e-mail.