Works with your stack
Cookie consent for WPForms
recaptcha or hcaptcha, both asked
WPForms Lite sets no cookie for your visitors. The captcha you pick for a form can: reCAPTCHA and hCaptcha both need consent by default in Cookie Rocks, Turnstile does not. WPForms loads the captcha only on pages that show a form using it.
By WPForms · wpforms.com · WordPress.org
Is this your product? Tell us if anything here is out of date. Write to us
WPForms
WordPress plugin
- Tested version
- 2.0.4
- How
- Tested automatically around each Cookie Rocks version
- Last test
- 7 November 2026
- Latest version
- 2.0.4 tested
- Active installs
- 5,000,000+
What WPForms adds to your visitors’ browser
No trackers In our test of WPForms 2.0.4 on 7 November 2026, the plugin itself added no tracker and no cookie. What you place in your pages with it, such as a video or a map, still counts.
What WPForms puts on your pages
- The form
- Its script and styles, served by your site. WPForms Lite sets no visitor cookie, and its form analytics count views on your own site, without cookies.
- A captcha, if you choose one
- Google reCAPTCHA, hCaptcha or Cloudflare Turnstile, loaded only on pages with a form that uses it.
- WPForms Pro
- Sets a first-party cookie with a random visitor ID, kept for years, for related entries, geolocation and form abandonment. Address fields can load Google Places or Mapbox.
- Payments
- Stripe, Square or PayPal load their own scripts on payment forms.
What matters for consent with WPForms
No token, no entry
When the captcha is missing, WPForms shows an error and saves nothing. Cookie Rocks stops the submit first and points to the note on the form, so the visitor knows what to do.
Two captchas, one rule
reCAPTCHA and hCaptcha are both held until the visitor allows them. The note on each WPForms form names the one it uses, and its button allows that captcha alone.
reCAPTCHA from recaptcha.net
Cookie Rocks makes WPForms load reCAPTCHA from recaptcha.net instead of google.com. That switch does not exist for hCaptcha.
Answers kept
After the visitor allows the captcha, the page reloads and text fields, choices and checkboxes come back. Passwords, files and hidden fields do not.
The Pro visitor cookie
WPForms Pro sets its visitor ID cookie as soon as a page shows a form. If you do not need the features behind it, turn on GDPR Enhancements, then Disable User Cookies, in its settings.
Cookie Rocks with WPForms
- When reCAPTCHA or hCaptcha waits for consent, shows an “Allow” request at the top of its forms.
- Holds sending until reCAPTCHA is allowed, and puts back what the visitor typed after the page reloads.
- Serves reCAPTCHA from recaptcha.net, without the cookies of google.com.
What our tests found on WPForms
Good to knowCookie Rocks lists Wordfence, Forminator, WP WhatsApp and WPForms Pro cookies
- Each appears in its cookie list with its purpose.
- Wordfence: wfCBLBypass, wf_loginalerted_*, wfls-remembered-*.
- Forminator: poll-cookie-*, forminator_stripe_payment_owner.
- WP WhatsApp: nta-wa-gdpr. WPForms Pro: _wpfuuid.
Read in its code, 18 October 2026.
Full detail
Cookie Rocks lists the site cookies of Wordfence (wfCBLBypass, wf_loginalerted_*, wfls-remembered-*), Forminator (poll-cookie-*, forminator_stripe_payment_owner), WP WhatsApp (nta-wa-gdpr) and WPForms Pro (_wpfuuid) in the cookie list it writes, with their purpose.
Good to know · Contact Form 7, WPForms Lite, Forminator, Fluent Forms, Ninja FormsFive form plugins set nothing on a default home page
by default: Default settings
With default settings and no form on the page, Contact Form 7, WPForms Lite, Forminator, Fluent Forms and Ninja Forms set no cookie, store nothing and load no known third-party tool.
Seen in our tests, 17 October 2026, Contact Form 7, WPForms Lite, Forminator, Fluent Forms, Ninja Forms 6.2.2, 2.0.2.2, 1.58.2, 6.2.16, 3.15.6.
Full detail
On a fresh WordPress home page with default settings, Contact Form 7, WPForms Lite, Forminator, Fluent Forms and Ninja Forms set no cookie, keep nothing in the browser's storage and load no known third-party tool, before or after Accept all (no form or captcha placed on the page).
Set before the choice · WPForms LiteWPForms loads its captcha only on pages with a form that uses it
It loads reCAPTCHA, hCaptcha or Turnstile in the footer of those pages only. Its No-Conflict mode removes other captcha scripts, but not those from recaptcha.net.
Read in its code, 16 October 2026, WPForms Lite 2.0.2.2.
Full detail
WPForms loads its captcha only on pages that show a form using it, in the footer: reCAPTCHA (www.google.com/recaptcha/api.js), hCaptcha (hcaptcha.com/1/api.js) or Turnstile (challenges.cloudflare.com); the address can be changed with the wpforms_frontend_captcha_api filter. Its No-Conflict mode dequeues other scripts from google.com/recaptcha, gstatic.com/recaptcha and hcaptcha.com/1, but not recaptcha.net. It sends a Permissions-Policy header for private state tokens on every request.
Good to know · WPForms LiteWPForms Lite sets no cookie for visitors
Lite does not write its _wpfuuid cookie unless a consent function allows it. Form analytics send views to the site itself, with no cookie or storage. It does not use WP Consent API.
Read in its code, 16 October 2026, WPForms Lite 2.0.2.2.
Full detail
WPForms Lite sets no cookie for visitors: its front script writes _wpfuuid (random ID, 3,999 days, SameSite=Strict) only if uuid_cookie is true, which Lite hardcodes to false, or if a wpforms.hasRequiredConsent JavaScript function exists and returns true. Form analytics (2.0) send form-view data to the site's own admin-ajax.php by sendBeacon, with an in-memory session ID, no cookie or storage, and skip authors, editors and administrators. It does not use WP Consent API.
How we test it
Around each version, with its latest release
Around each Cookie Rocks version, a fresh WordPress installs its latest version from WordPress.org next to Cookie Rocks and runs the same checks. A new version joins the next run on its own.
- WPForms 2.0.4, tested on 7 November 2026.
- The banner shows, the trackers of the test page wait for consent and load after it, and Cookie Rocks raises no PHP error.
- Settings of the test: Default settings after activation.
- Last run: WPForms 2.0.4 on 7 November 2026, with WordPress 7.1.3.
Forms and captchas
Other plugins of the same kind.
Questions
What if a visitor clicks Submit first?
The submit is stopped and the note on the form is highlighted. WPForms would reject the form for a missing captcha anyway.
Can I avoid the note entirely?
Yes. Use the honeypot built into WPForms, or Cloudflare Turnstile, instead of reCAPTCHA or hCaptcha. Turnstile is treated as necessary and never held.
Should I turn on the No-Conflict mode of WPForms?
Leave it off unless WPForms support asks for it. It removes other plugins’ captcha scripts from the page.
What happens after the 30-day trial?
The banner, your visitors’ choices and your proofs of consent keep working. Without a key, most settings lock, updates and support stop. Take a key at any time and everything opens again.
For WPForms sites
Your forms keep every answer.
answers survive the reload
Every feature of the complete plugin for 30 days, no card. WPForms keeps working as it does today.
- During the trial: everything, including the full settings and the scans
- After 30 days without a key: the banner, your visitors’ choices and your proofs of consent keep working
- What waits for a key: most settings, updates and support
Get your trial key
Your e-mail and your site. Your key arrives as soon as you confirm your e-mail.