KillerConversions – Contact Form Builder

KillerConversions is a free WordPress contact form builder for customer enquiries, quote requests and project briefs. Build forms visually, show relevant questions with conditional logic, and save submissions in your WordPress dashboard. Choose email notifications or Inbox only.

Free needs no vendor account, licence key or marketing signup.

Try the Free demo | Try the Pro demo | Compare Free and Pro

Try a temporary WordPress workspace with fictional examples and no signup. Outgoing email and external connections are blocked. Use sample information; demo work is temporary.

What is included in Free?

• Visual form builder: templates, field editing, keyboard reordering, preview and design drafts before publishing.
• Conditional fields: show or hide follow-up questions based on previous answers.
• Local form entries: search, filter, star, mark read/unread, assign and export submissions to CSV.
• Optional notifications: configure staff emails and separately requested visitor confirmations, or use Inbox only. Review failures in Delivery; sending depends on your site’s mail setup.
• Spam protection: honeypot, submission rate limiting and optional Cloudflare Turnstile with your own widget keys.
• Repeatable fields: let visitors add rows of supported details, within the documented limits.
• Publishing and data controls: WordPress block and shortcode, design recovery/history, retention, eligible privacy export/erasure and sanitised configuration import/export.
• Newsletter connections: optionally send separately consenting subscribers to a configured Brevo list or MailerLite group.

No artificial form/submission quota, trial expiry or forced attribution. Hosting resources, storage budgets, retention and documented safety limits apply.

Forms you can build

Create a business contact form, service enquiry, quote request, agency brief, callback request, consultation request or customer feedback form. Consultation requests do not provide appointment booking; quote requests collect requirements without calculating prices.

What does Pro add?

Pro is a separate paid add-on:

• Calculated estimates and branded PDFs: quantity × unit-price rows, fixed extras, advanced pricing and server-calculated itemisation.
• Multi-step applications and private uploads: supported PDF, PNG, JPEG or UTF-8 TXT attachments within hosting limits.
• Visitor save and resume: explicitly saved incomplete applications with private return links. Incomplete answers are not captured automatically.
• Advanced workflows: nested conditions, branching, routing, connections and team-review tools with deliberate setup.

Free includes basic conditions and administrator design drafts; visitor save-and-resume is Pro. Free’s optional Pro previews use fictional examples and can be hidden. Opening them does not enable features or send browsing activity.

All Pro plans include the same features for 1, 3 or 10 websites. Pro needs separate installation and initial licence activation; see the FAQ below.

Useful alongside your forms

Optional plugins from the same publisher, Plugins.shop. None is required or implies a built-in integration:

• ClickClue — session replay — Review eligible recorded visits to form pages using your chosen recording mode and privacy controls.
• CampaignBars — announcement bars — Link an announcement button to your contact or quote-request page.
• CatalogFAQ — FAQ accordions — Publish reusable answers beside an enquiry form so visitors can check common questions first.

Privacy, storage and external services

Local core form use makes no publisher telemetry, licence or marketing requests. The optional website registration and marketing signup described below make requests only after explicit choices. Assets are bundled locally except the explicitly enabled Turnstile service below. Completed entries, files and provider credentials are private database data, not encrypted at rest by the plugin. Protect database access and backups.

KillerConversions optional website registration and emails

After explicit administrator selection, the plugin sends the displayed hostname for website registration, or the selected email address for an independently confirmed request for tutorials, product updates and occasional offers, to https://killerconversions.com/newsletter-api/v1/kc-welcome/. Each request includes its consent wording version, time and a random scoped connection reference. Email-only requests omit the site URL from the body and HTTP headers. Neither purpose sends form answers, customer lists, licence credentials or preview-click history. A voluntarily reported domain is not verified domain ownership or a count of active installations. These choices are independent of Pro licensing and of visitor subscriptions to Brevo or MailerLite.

Privacy & emails lets you stop domain sharing and manage the email request made there. Confirmed email preferences and unsubscribe are available through private email links. An unreachable service leaves a truthful retryable removal state; local sharing stops immediately. Copied or moved sites pause the connection and require fresh choices. Use the original site’s controls or private email links to manage its existing relationship. Before explicitly removing all local plugin data, complete remote withdrawal; uninstall alone cannot guarantee it. Privacy: https://killerconversions.com/privacy/#plugin-registration . Terms: https://killerconversions.com/checkout/terms .

Domain reports expire after 90 days without another explicit request; no heartbeat is sent. Initial enrollment retries and pending email confirmations expire after 48 hours. Confirmed subscriptions expire after at most 730 days. The credential and consent attribution needed to stop emails requested here remain while that connected subscription is active. Stopped or unattached opaque controls expire after 90 days; consent and suppression records may remain for 180 days. Scheduled cleanup and backups have separate retention limits. The service receives the connection IP; hosting and email delivery service details are in https://killerconversions.com/newsletter/privacy .

Focus, preview visibility and explicit Remember this workflow choices stay local. A remembered workflow is retained for seven days and rechecks the saved form before continuation. Browsing a preview does not record a workflow choice or grant permission to send data. The optional consent record contains private connection material needed for authenticated withdrawal; privacy exports do not include that credential.

When Pro is active, saved visitor drafts are encrypted using Sodium and WordPress salt-derived keys; changing or losing those salts can make existing drafts unreadable. The plugin reports decryption failure without exposing answers or tokens. Resume tokens are hashed in storage and live in the private link fragment. Anyone holding a valid link can access that draft. Expiry runs from first save; consent/permission choices need a fresh visitor decision. Quota failure preserves an existing saved application. Site backups have their own retention.

Entry retention defaults to 90 days and can be set to 1–3650 days for new entries. Daily cleanup and additional batches for large backlogs depend on WordPress cron. Retention health shows queued or overdue continuation work and cleanup failures. Pro visitor draft storage is capped at 64 MiB per form and 256 MiB per site; hosting capacity can reduce limits. Completed-entry/file storage has a baseline site budget and a health display. Deleting an entry removes linked files and jobs. Privacy exports/erasure locate entries by submitted email fields; records without one need administrator review. Email/provider copies are outside local erasure.

Optional editor recovery stores a design in that administrator’s browser for up to 24 hours, excluding credentials, recipients and nonces. Ten-design history is local. Explicitly remembered workflow links are local per-administrator references with seven-day expiry. These actions make no external request.

New entries retain original field definitions. Same-page browser retries use a random attempt ID held in memory; the database retains its hash and committed entry reference until erasure/expiry. This does not cover a fresh page load, legacy clients or the no-JavaScript fallback. Abuse protection uses short-lived salted rate hashes, not stored raw IPs. Submitted-entry counts require no visitor tracking.

Transactional email

When configured, the queue passes the selected staff notification or separately requested visitor confirmation to WordPress wp_mail() and your site’s mail provider. A submitted email can become validated Reply-To; it does not replace From. Estimates include their saved breakdown. Confirmation consent, marketing subscription and saved-link purposes remain separate. The plugin provides no SMTP service, bounce tracking or receipt guarantee. Disable a destination to stop future jobs; delivered copies need separate removal.

Brevo (optional)

An administrator explicitly enables and acknowledges this connection. With a separately checked optional visitor marketing-consent question, the plugin sends the mapped email, optional FIRSTNAME/LASTNAME and selected list ID to https://api.brevo.com/v3/contacts to create/update a subscriber contact. It does not send unrelated answers or files, force unsubscribe flags, perform double opt-in or send a campaign. Your Brevo list automations may run. Disable the connection to stop future requests; remove its saved credential to forget it locally. Provider copies require separate removal. Terms: https://www.brevo.com/legal/termsofuse/ ; privacy: https://www.brevo.com/legal/privacypolicy/ .

MailerLite (optional)

After administrator enablement/acknowledgement and separate optional visitor subscription consent, the plugin sends mapped email, optional name and selected group ID to https://connect.mailerlite.com/api/subscribers to create/update a subscriber. It does not send files or unrelated answers, request forced resubscription, or send a campaign. Group automations may run under your provider settings. Disable and remove credentials to stop future local requests; provider data needs separate removal. Terms: https://www.mailerlite.com/legal/terms-of-service ; privacy: https://www.mailerlite.com/legal/privacy-policy .

Changing a destination, mapping or consent meaning cancels old pending work instead of reinterpreting it. Reviewed resend preserves recorded consent. Copied-site protection pauses outgoing work after a recorded address/environment change; identical-identity copies and pre-baseline copies need operator review.

Cloudflare Turnstile (optional)

Turnstile defaults off and needs widget keys plus service acknowledgement. Enabled forms load https://challenges.cloudflare.com/turnstile/v0/api.js; Cloudflare processes browser/network signals. The server sends only the configured secret and challenge token to https://challenges.cloudflare.com/turnstile/v0/siteverify. Form answers are not included. Protected forms require JavaScript; editor preview never loads it. Disable protection to stop requests and remove the saved secret to forget it. Privacy: https://www.cloudflare.com/turnstile-privacy-policy/ ; terms: https://www.cloudflare.com/website-terms/ .

Data on uninstall

Deactivation and normal uninstall preserve forms and entries. Deliberate permanent removal requires define( 'KCONV_DELETE_DATA_ON_UNINSTALL', true ); in wp-config.php before uninstalling Free. Back up needed data first. This removes plugin-owned data for the current site; it does not retract email/provider copies or release a remote licence seat. Multisite network removal is unsupported.

Source code

All first-party PHP, JavaScript and CSS source is included in this plugin. The readable files in assets/ and blocks/form/editor.js are the exact editable files WordPress loads; there are no separate minified bundles or required build steps. See SOURCE.txt for the source map, optional formatting instructions and bundled font/PDF attribution. WordPress supplies the declared wp-* JavaScript dependencies through its own script loader; no copies of those libraries are bundled here.

Developer notes

All executable source ships in readable form. No compilation is needed. The optional remote services are disclosed above.

The fictional PDF example embeds DejaVu Sans; font notices are in assets/pro-estimate-sample-LICENSE.txt.