Forminator ability reference
Reference for the GoBuildWP Pro 1.12.4 and Free 1.18.6 source. Installed schemas and policy remain authoritative.
This Forminator ability reference explains how an agent reads Forminator forms and the entries visitors left in them without receiving their contact details, and how it rewords a form in a way the change log can reverse. Forminator polls and quizzes sit outside the module; its listing covers forms alone.
Read-only, write and destructive groups describe the source annotations. They do not establish a minimum safety profile, human approval or undo support. Those controls are separate: check the installed ability, the connected user and the active site policy before calling it. A read can still return sensitive data. These pages are not evidence that every operation passed an end-to-end runtime test.
What Forminator needs before these load
2 of the 4 also ship in GoBuildWP Free 1.18.6 under the same names, marked “Also in GoBuildWP Free” below. They need no GoBuildWP Pro licence, but each retains its own dependency, feature and permission checks. Where Free's copy does less, its own description follows Pro's. When Pro's richer copy passes its gates, it registers first and answers.
Forminator by WPMU DEV has to be active. The manifest row loads the module when it finds the Forminator_API class or the FORMINATOR_VERSION constant, and the kit also relies on Forminator_Base_Form_Model and Forminator_Form_Entry_Model. No GoBuildWP version floor applies; the calls were checked against Forminator 1.57.3. Each call asks for the capability Forminator's own admin screens use, as forminator_get_admin_cap() reports it, and falls back to manage_options when that function is missing. Switch Forminator off and the module stops loading. Without a Pro licence the list calls withhold exactly what Pro's do; reading a whole form and the edit call are Pro's.
- Forminator editions
- free, pro
Entries arrive with contact details stripped
Forminator keeps entries in its own tables, and this module reads them without ever writing. Each answer is mapped onto Pro's shared redaction vocabulary before it is judged: upload fields count as files, and stripe, stripe-ocs and paypal fields count as card data, so they return "[REDACTED]" along with passwords, signatures and the submitter's IP. Email and phone answers are withheld on every entry. Free text is scanned too: an email address, or any run of digits and number separators holding seven or more digits, is replaced and flagged contact_in_text. Answers in date, time, number and similar numeric fields are not scanned, but a long order number or a date typed into a free-text answer can still be cut out. Spam and draft entries are skipped.
Notifications get the same caution. forminator-get-form describes each one by label, whether it uses routing rules, recipient_count, how many recipients are pulled from form fields, bcc_count and the subject with contacts masked, but never an address. It also reports store_entries, which is false when the form is set not to save submissions at all.
A form is one post and one meta key
Every Forminator form is a forminator_forms post, and its forminator_form_meta meta holds fields, settings and notifications as a single array. The name Forminator displays is settings.formName; the post title normally matches it, but a form made through Forminator_API::add_form() carries a slug there instead, so the module reads formName. The submit button text sits at settings.submitData.custom-submit-text. Fields are addressed by Forminator's own ids such as email-1, every id is checked before anything is saved, and the form is saved once through its model and read back; a mismatch returns forminator_update_unverified.
Because the form is that compact, undo is simple. Before wppilot/forminator-update-form runs, the ledger captures a kits/post-partial snapshot of post_title and forminator_form_meta. wppilot/rollback-change writes both back and compares a fingerprint of the result. The catch is that the entire meta array returns, so any change made later in Forminator's builder to that same form is reverted as well.
Example Forminator input: wppilot/forminator-get-form
This one operation declares the 1 top-level input parameters below in wppilot-pro/includes/kits/forms-forminator/src/abilities/get-form.php; form_id is required. Other calls in this module take different arguments. Nested schemas and constraints are not expanded here; the complete live schema a connected client discovers is authoritative.
| Parameter | Type and meaning |
|---|---|
form_idrequired | integer |
Representative call sequence
This sequence describes the documented calls and checks to perform. It is not a recorded result from an installed WordPress site. Inspect returned errors and partial results, then verify the saved values and affected output before proceeding.
Change the newsletter form's button to Subscribe, check September's sign-ups, then put the button back.
- 01
wppilot/forminator-list-formsReturns the newsletter form's id alongside its entry count and shortcode. - 02
wppilot/forminator-update-formSaves the new submit_text through Forminator's form model and returns the new and previous values. - 03
wppilot/forminator-list-entriesLists entries between 2026-09-01 and 2026-09-30 in site time, with email answers redacted. - 04
wppilot/rollback-changeRestores the title and form settings captured before the edit and verifies them by fingerprint.
Questions about Forminator
Will undoing a Forminator edit discard changes I made afterwards in the builder?
It can. The undo restores the form's whole settings array as it stood before the agent's edit, so later builder changes to that form are reverted too.
Can the agent see where Forminator notification emails are sent?
No. It sees how many recipients each notification has and how many come from form fields; the addresses stay under Forminator > Forms > Email Notifications.
Can the agent add a field or change a payment setting?
No. The edit covers the title, submit button text and each field's label, placeholder and required flag; adding, removing, moving or retyping fields, and notifications, integrations and payments, are left to Forminator's builder.
Forminator reads
| Ability | What it does |
|---|---|
wppilot/forminator-get-formGet a Forminator Form | One Forminator form by form_id: title, status, shortcode, submit_text (the submit button label), and every field in order with its id (e.g. "email-1", which wppilot/forminator-update-form takes), type, label, placeholder, required, layout_only (true for HTML, page breaks, sections and captcha) and options (label and value, for selects, radios and checkboxes). settings gives the submission behaviour, whether it submits over AJAX, whether entries are stored, and when the form expires. notifications gives each email notification's label, recipient_count, how many recipients come from a field the visitor fills in, bcc_count and subject; the addresses themselves are never returned. Read-only. |
wppilot/forminator-list-entriesList Forminator EntriesAlso in GoBuildWP Free | Submitted entries for one Forminator form, newest first: id, date_created (site time), status, and answers (field_id, label, type, value). Contact details and sensitive fields are withheld (names and other answers are not):email and phone answers, passwords, card and payment data, uploads, signatures and the submitter's IP come back as "[REDACTED]" with a redacted reason, and email addresses or phone numbers typed into any other answer are cut out of it (redacted: "contact_in_text"). date_from and date_to (YYYY-MM-DD, site time, inclusive) narrow the range; limit defaults to 20 (max 100), offset pages; total counts every matching entry. Spam and draft entries are not listed. Read-only. In GoBuildWP Free: Submitted entries for one Forminator form, newest first: id, date_created (site time), status, and answers (field_id, label, type, value). Contact details and sensitive fields are withheld (names and other answers are not):email and phone answers, passwords, card and payment data, uploads, signatures and the submitter's IP come back as "[REDACTED]" with a redacted reason, and email addresses or phone numbers typed into any other answer are cut out of it (redacted: "contact_in_text"). Names and other answers are returned as submitted. There is no option to return the withheld values; a person can see them in Forminator > Submissions. date_from and date_to (YYYY-MM-DD, site time, inclusive) narrow the range; limit defaults to 20 (max 100), offset pages; total counts every matching entry. Spam and draft entries are not listed. Read-only. |
wppilot/forminator-list-formsList Forminator FormsAlso in GoBuildWP Free | Lists the site's Forminator forms (not polls or quizzes), newest first: id, title, status (publish or draft), field_count (fields that take an answer, not layout blocks), entry_count (stored, non-spam entries) and the shortcode that embeds it. status filters to publish or draft; limit defaults to 20 (max 100) and page starts at 1; total is the number of matching forms. Read-only. |
Forminator writes
| Ability | What it does |
|---|---|
wppilot/forminator-update-formUpdate a Forminator Form | Makes a small, safe edit to one Forminator form: its title, the submit button text (submit_text), and for any of its fields the label, placeholder or required flag. Fields are named by the id wppilot/forminator-get-form returns ("email-1"). It cannot add, remove, move or retype fields, or touch notifications, integrations or payments. Every field id is checked before anything is saved, and the form is saved once through Forminator's own form model, then read back; the result lists the new values and the previous ones. Undoable: the change log keeps the form's title and settings from before the edit, and wppilot/rollback-change puts them back and checks them. |
For the task-level view of Forminator, with worked requests and what to check afterwards, see Forminator integration page.