Title: Secure Encrypted Form Author: Daniel Pereyra Costas Published: 14 February 2023 Last modified: 27 September 2026 --- Search plugins ![](https://ps.w.org/secure-encrypted-form/assets/banner-772x250.jpg?rev=2865133) ![](https://ps.w.org/secure-encrypted-form/assets/icon-256x256.png?rev=2865133) # Secure Encrypted Form By [Daniel Pereyra Costas](https://profiles.wordpress.org/danidub/) [Download](https://downloads.wordpress.org/plugin/secure-encrypted-form.1.3.0.zip) * [Details](https://en-gb.wordpress.org/plugins/secure-encrypted-form/#description) * [Reviews](https://en-gb.wordpress.org/plugins/secure-encrypted-form/#reviews) * [Installation](https://en-gb.wordpress.org/plugins/secure-encrypted-form/#installation) * [Development](https://en-gb.wordpress.org/plugins/secure-encrypted-form/#developers) [Support](https://wordpress.org/support/plugin/secure-encrypted-form/) ## Description This plugin allows you to insert a _“secure form”_ into your website through a simple shortocde. It is usefull when you need to **receive sensitive data of any kind, establishing a _“safe channel”_**. The data is sent encrypted with your PGP public key. #### Usage Just fill in some plugin options: * The destination email (your email) * Your PGP public key in ASCII armored version Hint: to see your private key you can enter your computer console and run two commands, one to list and one to export (must have GnuPG): ``` gpg --list-keys gpg --armor --export username@email ``` Remember your public key needs to be exported in ASCII armored version, this means that will be surrounded with: ``` -----BEGIN PGP PUBLIC KEY BLOCK----- your-long-key-string-will-be-here -----END PGP PUBLIC KEY BLOCK----- ``` Once the shortcode is placed into a page or post, it will render a form with the following fields: * Name * Email * Subject * Message #### How it works The _message_ field will be encrypted with your **PGP public key** and sent as an attachment in **ASCII** format to the destination email you have configured. When creating the plugin logic I have made sure that the _message_ field **is never sent to the web server**, the data is previously encrypted (on the fly) using _OpenPGP. js_ library in the user who is browsing the website. You will only be able to decrypt the content of the attached file if you have the PGP private key belonging to the public key with which the message was encrypted. _Remember that the purpose of the plugin is only to display a form on your website and encrypt the information that is sent through the “message” field. This plugin does not take care of decrypting the attached file, this task is left to each user in the way they want._ #### Some usage examples * Receive secret messages * Receiving passwords from clients or friends * Reception of sensitive information * Offering a private channel to sources, whistleblowers or people asking for help #### Why private communication matters Some messages cannot travel through an ordinary contact form. A source writing to a journalist, an employee reporting wrongdoing inside their own company, a lawyer receiving documents from a client, someone asking for help where asking is itself dangerous: for all of them, whether the channel is private is not a detail, it is the entire point. A normal contact form sends the message in plain text to the web server, where it is kept in the database, in mail logs and in whatever backups the hosting provider takes. Every one of those copies is a place where it can be read, demanded or leaked. This plugin encrypts the message in the visitor’s browser, so what reaches the server is already unreadable to everyone, including you until you decrypt it with your private key, and including your hosting provider. The Universal Declaration of Human Rights protects both freedom of expression and privacy of correspondence, and the two hold each other up: people only speak freely when they can choose who is listening. Giving your readers a channel that does not betray them is a small, practical way of defending that. #### What this plugin does not do Encrypting the message is one piece of a larger picture, and it is only honest to say where the picture ends. * The name, email and subject fields are **not** encrypted. Only the message is. Anyone who can read your server can see who wrote and what the subject was. * The plugin does not hide the fact that someone visited your website. * It cannot protect a message once you have decrypted it on your own computer. If someone’s safety depends on this channel, the way they reach your site and the way you store what you receive matter just as much as the encryption itself. #### Requirements **Your site must be served over HTTPS.** The message is encrypted by the visitor’s browser, and browsers only allow encryption on secure connections. On a plain HTTP site no message can be sent at all. If your site is not on HTTPS yet, ask your hosting provider for an SSL certificate, they are usually free. In order to use this plugin you need to have or create a **PGP key pair**. If you don’t have your key pair generated you can browse the internet on how to generate it. There are many ways to generate the key, each have a different impact on security. #### Recommended software * [GNU Privacy Guard (Linux, OS X, Windows)](https://gnupg.org) * [GPG Suite (OS X)](https://gpgtools.org) * [Gpg4win (Windows)](https://www.gpg4win.org/) #### Support When you cannot find the answer to your question on the FAQ section, check the [support forum](https://wordpress.org/support/plugin/secure-encrypted-form/) on WordPress.org. If you cannot locate any topics that solve to your particular issue, post a new topic for it. Remember this support is offered for free and can take some hours/days to answer and solve your issues. #### Supporting the plugin This plugin is free and stays free. It is maintained in the time left over from paid work, which is the honest reason why some things take a while. If your organisation needs something it does not do yet, a custom field, an integration with your own systems, or a hand setting up your key pair and the form, that work can be commissioned at [charrua.es](https://charrua.es/). Paying for a feature is what funds the hours behind the plugin, and whenever a change makes sense for everyone it goes into the free version too, so the work ends up in the hands of people who could never have paid for it. That is the arrangement we like: those who can afford it pay for the tools that everyone else gets to use. #### Spam protection (optional) The plugin can add a [Cloudflare Turnstile](https://www.cloudflare.com/products/turnstile/) challenge to the form. It is **disabled by default** and does nothing until you enable it and enter your site key and secret key in the plugin settings. The message is always encrypted in your visitor’s browser before anything is sent, with or without Turnstile. If Cloudflare cannot be reached, submissions are allowed through and the problem is written to the diagnostic log, so an outage never costs you a legitimate message. #### Privacy notices With the default configuration, this plugin, in itself, does not: * Track users by stealth * Write any user personal data to the database * Send any data to external servers * Use cookies #### External services This plugin does not connect to any external service unless you enable Cloudflare Turnstile in its settings. When you do enable it, the plugin relies on Cloudflare Turnstile to tell human visitors apart from bots: * The form loads the Turnstile widget script from `https://challenges.cloudflare. com/turnstile/v0/api.js`. Loading it makes the visitor’s browser contact Cloudflare, which collects the data described in their documentation to run the challenge. * When the form is submitted, your server sends the token produced by the widget, together with your secret key, to `https://challenges.cloudflare.com/turnstile/ v0/siteverify` to check whether the challenge was passed. * The plugin never sends the message, the form fields or the visitor’s IP address to Cloudflare. Cloudflare’s [terms of service](https://www.cloudflare.com/website-terms/) and [privacy policy](https://www.cloudflare.com/privacypolicy/) apply to that service. #### Translations Actually the plugin ships in English and is translated to Spanish. You can contribute and [translate this plugin to your own language](https://translate.wordpress.org/projects/wp-plugins/secure-encrypted-form/). ## Screenshots [⌊Plugin settings: destination email, your OpenPGP public key and the diagnostic log level.⌉⌊Plugin settings: destination email, your OpenPGP public key and the diagnostic log level.⌉[ Plugin settings: destination email, your OpenPGP public key and the diagnostic log level. [⌊Optional spam protection with Cloudflare Turnstile, disabled by default.⌉⌊Optional spam protection with Cloudflare Turnstile, disabled by default.⌉[ Optional spam protection with Cloudflare Turnstile, disabled by default. [⌊The form as your visitors see it.⌉⌊The form as your visitors see it.⌉[ The form as your visitors see it. [⌊The same form with the Turnstile challenge enabled.⌉⌊The same form with the Turnstile challenge enabled.⌉[ The same form with the Turnstile challenge enabled. [⌊The diagnostic log, which never records email addresses or subjects.⌉⌊The diagnostic log, which never records email addresses or subjects.⌉[ The diagnostic log, which never records email addresses or subjects. [⌊Inserting the form in any page or post with a shortcode.⌉⌊Inserting the form in any page or post with a shortcode.⌉[ Inserting the form in any page or post with a shortcode. ## Installation 1. Upload the entire `secure-encrypted-form` folder to the `/wp-content/plugins/` directory. 2. Activate the plugin through the **Plugins** screen (**Plugins > Installed Plugins**). You will find **Secure Encrypted Form** menu in your WordPress admin screen. Once configured, insert the form in any page or post using the shortcode `[secure-encrypted- form]`. ## FAQ ### How to prevent and filter SPAM? The plugin has built in support for Cloudflare Turnstile. Create a free Turnstile site in your Cloudflare dashboard, then enable it in the plugin settings and paste the site key and the secret key. It is off by default. ### The Turnstile widget does not appear, and the form says the spam check could not be completed This is almost always a caching or optimisation plugin combining, minifying or deferring the Cloudflare script. Turnstile needs its own script tag to start, so when it is merged into a bundle the widget never renders, no token is produced, and the form rejects the submission. The browser console usually shows “Could not find Turnstile valid script tag”. The plugin already asks SiteGround Speed Optimizer, LiteSpeed Cache, WP Rocket and Autoptimize to leave that script alone, and marks it in the page so other optimisers skip it too. If yours does not honour that, exclude this script by hand: ``` https://challenges.cloudflare.com/turnstile/v0/api.js ``` It is registered under the handle `cloudflare-turnstile`, which is what some plugins ask for instead of the URL. Exclude it from combining, from minifying and from deferring, then clear every cache. ### I get an error about my encryption key, but the key is fine Check that your site is served over HTTPS. Browsers only give access to the encryption API on secure connections, so on an HTTP site the form cannot encrypt anything. From version 1.3.0 the plugin tells you this directly, both in the admin and in the form. ### My server is not sending emails Your server may be restricted or disabled to send emails. In that case you can use a SMTP plugin to send authenticated emails as [WP Mail SMTP](https://es.wordpress.org/plugins/wp-mail-smtp/). Always remember to check your SPAM folder. ## Reviews ![](https://secure.gravatar.com/avatar/3b2c458d6e0dc535f75ba4175f9bf0ed51e601dbb911f1ee9cfd0d42bf83745a? s=60&d=retro&r=g) ### 󠀁[Excellent product and FREE!](https://wordpress.org/support/topic/excellent-product-and-free/)󠁿 [ericbonetti2017](https://profiles.wordpress.org/ericbonetti2017/) 26 September 2026 1 reply Why pay a hosted form provider for all sorts of glitzy form features when you can use this plugin for free? And, while most forms send email in the clear, if you enter your PGP public key, you have true end-to-end encrypted communication. Also, the developer is great and very responsive. Will definitely use him for future projects. ![](https://secure.gravatar.com/avatar/ccfb0d642cbc5766b74676ae1587e7d1d0b6503b4f6c7fd03b9a0cd40d6a7919? s=60&d=retro&r=g) ### 󠀁[Works well + One suggestion 😉](https://wordpress.org/support/topic/works-well-one-suggestion/)󠁿 [BlogLogistics](https://profiles.wordpress.org/ac2a/) 15 November 2024 2 replies Works exactly as described, and works well on WordPress 6.7! One improvement would be adding a feature to enable Cloudflare Turnstile as a private captcha option to avoid bot submissions. Can anyone provide input for this? ![](https://secure.gravatar.com/avatar/7ab5ffe69d7e122adaa93c534ee0843270d21e181e989985df19e2f6a0a88625? s=60&d=retro&r=g) ### 󠀁[Perfect plugin – sensing data](https://wordpress.org/support/topic/perfect-plugin-sensing-data/)󠁿 [dominikaes](https://profiles.wordpress.org/dominikaes/) 27 July 2023 1 reply The perfect plugin for sending data, including sensitive data that needs to be secured. ![](https://secure.gravatar.com/avatar/b779b9c8ece6f17237ea1f33eb7902e1ce0b100af1a7baa0f91204007a8f2e1a? s=60&d=retro&r=g) ### 󠀁[Excelent for privacy protect](https://wordpress.org/support/topic/excelent-for-privacy-protect/)󠁿 [David Viña](https://profiles.wordpress.org/soivigol/) 25 March 2023 1 reply This plugin is an excellent tool to protect messages that contain passwords, banks data and other sensible information. It is an ideal plugin to share data between partners or collaborators.It is a great step to protect our privacy! [ Read all 4 reviews ](https://wordpress.org/support/plugin/secure-encrypted-form/reviews/) ## Contributors and Developers “Secure Encrypted Form” is open source software. The following people have contributed to this plugin. Contributors * [ Daniel Pereyra Costas ](https://profiles.wordpress.org/danidub/) “Secure Encrypted Form” has been translated into 2 locales. Thank you to [the translators](https://translate.wordpress.org/projects/wp-plugins/secure-encrypted-form/contributors) for their contributions. [Translate “Secure Encrypted Form” into your language.](https://translate.wordpress.org/projects/wp-plugins/secure-encrypted-form) ### Interested in development? [Browse the code](https://plugins.trac.wordpress.org/browser/secure-encrypted-form/), check out the [SVN repository](https://plugins.svn.wordpress.org/secure-encrypted-form/), or subscribe to the [development log](https://plugins.trac.wordpress.org/log/secure-encrypted-form/) by [RSS](https://plugins.trac.wordpress.org/log/secure-encrypted-form/?limit=100&mode=stop_on_copy&format=rss). ## Change Log #### 1.3.0 * Added a note on how to support the plugin: commissioning custom work is what funds it, and changes that make sense for everyone land in the free version. * Rewrote parts of the plugin description: why a private channel matters, and an honest list of what the plugin does not protect. * Removed the donation panel, links and email footer. The donation page no longer exists. * The Cloudflare Turnstile script is now excluded from the optimisations of SiteGround Speed Optimizer, LiteSpeed Cache, WP Rocket and Autoptimize, and marked so other optimisers skip it. Combining or deferring that script stops the widget from appearing and makes the form reject every submission. * Added a “Delete all log files” button to the Debug log screen. Useful if you are upgrading from a version before 1.2.0, whose logs recorded the email addresses and subject of every message. * The plugin now warns you when your site is not served over HTTPS. Browsers only allow encryption on secure connections, so on an HTTP site no message can be sent, and until now the only symptom was an error blaming your encryption key. * The test email form now shows the underlying error instead of always reporting a problem with the public key. * Added optional spam protection with Cloudflare Turnstile, sponsored by @ericbonetti2017. It is disabled by default and needs both the site key and the secret key to switch on, so nothing changes unless you enable it. * If Cloudflare cannot be reached, or your secret key is wrong, messages are allowed through and the problem is written to the diagnostic log. A Cloudflare outage never costs you a legitimate message. * Your visitors’ IP addresses are never sent to Cloudflare. #### 1.2.0 * Security: log files are no longer written to a predictable, publicly reachable path inside the uploads folder. The log directory now carries a random suffix and ships with server rules that block direct web access. Existing logs are moved to the protected location automatically. Reported by @rayeason. * Security: the diagnostic log no longer records the sender email address or the message subject. * Security: hardened the log viewer so it can only open the plugin’s own log files. * Added a “Diagnostic log” setting with three levels: disabled, errors only (the default) and full log. The log folder is only created when there is something to write. * Logging is now handled by a single shared class instead of duplicated code in the admin and public sides. * Security: the test email form is now restricted to administrators. Its endpoint was also registered for logged out visitors and shared a nonce with the public form, so anyone could trigger test emails. * Fixed the form hanging on the spinner with no message when the encryption key has expired. An expired key fails when encrypting, not when it is read, and that case had no feedback. * Fixed an unexpected mail error leaving the form without an answer: the visitor got no feedback and nothing was written to the log. Any failure is now reported and logged. * Uninstalling the plugin now deletes its log files. * Updated Monolog from 2.8.0 to 2.11.1, which removes the deprecation notices shown on PHP 8.4 and newer. * Updated “Tested up to” to WordPress 7.1. * Fixed the version number declared when enqueuing OpenPGP.js (it still said 5.5.0 while the bundled library is 6.3.0), so browsers pick up the right cached file. #### 1.1.0 * Updated OpenPGP.js from v5.5.0 to v6.3.0. * Fixed silent encryption error when key is expired or invalid — now shows feedback to the user. * Improved form field order: name, email, subject, message. * Improved default form styling. * Renamed admin submenu item to “Settings”. * Updated “Tested up to” to WordPress 7.0. * Added “Requires PHP: 7.4”. #### 1.0.1 * Fixed donation links. * Added logs link on admin. * Added ‘from’ and ‘to’ parameters on logs. * Added detection for PHP mail() function. * Updated feedback messages. * Fixed initialization of plugin options, thanks to @nilovelez for commenting the problem. * Fixed options leading spaces on inputs. * Added loading status icon. #### 1.0.0 * Initial launch. ## Meta * Version **1.3.0** * Last updated **2 days ago** * Active installations **50+** * WordPress version ** 5.3 or higher ** * Tested up to **7.1.2** * PHP version ** 7.4 or higher ** * Languages * [English (US)](https://wordpress.org/plugins/secure-encrypted-form/), [Spanish (Chile)](https://cl.wordpress.org/plugins/secure-encrypted-form/) and [Spanish (Spain)](https://es.wordpress.org/plugins/secure-encrypted-form/). * [Translate into your language](https://translate.wordpress.org/projects/wp-plugins/secure-encrypted-form) * Tags * [contact form](https://en-gb.wordpress.org/plugins/tags/contact-form/)[encryption](https://en-gb.wordpress.org/plugins/tags/encryption/) [openpgp](https://en-gb.wordpress.org/plugins/tags/openpgp/)[privacy](https://en-gb.wordpress.org/plugins/tags/privacy/) [secure form](https://en-gb.wordpress.org/plugins/tags/secure-form/) * [Advanced View](https://en-gb.wordpress.org/plugins/secure-encrypted-form/advanced/) ## Ratings 5 out of 5 stars. * [ 4 5-star reviews ](https://wordpress.org/support/plugin/secure-encrypted-form/reviews/?filter=5) * [ 0 4-star reviews ](https://wordpress.org/support/plugin/secure-encrypted-form/reviews/?filter=4) * [ 0 3-star reviews ](https://wordpress.org/support/plugin/secure-encrypted-form/reviews/?filter=3) * [ 0 2-star reviews ](https://wordpress.org/support/plugin/secure-encrypted-form/reviews/?filter=2) * [ 0 1-star reviews ](https://wordpress.org/support/plugin/secure-encrypted-form/reviews/?filter=1) [Your review](https://wordpress.org/support/plugin/secure-encrypted-form/reviews/#new-post) [See all reviews](https://wordpress.org/support/plugin/secure-encrypted-form/reviews/) ## Contributors * [ Daniel Pereyra Costas ](https://profiles.wordpress.org/danidub/) ## Support Issues resolved in last two months: 1 out of 1 [View support forum](https://wordpress.org/support/plugin/secure-encrypted-form/)