Secure Form Options for Your WordPress Website

If your WordPress website collects any kind of user information, contact requests, intake forms, applications, or anything else, how that data is handled matters. Not all form solutions are created equal, and some popular options carry real security risks that site owners don’t always realize until it’s too late.

Here’s a rundown of what secure form options we recommend, what we don’t, and why.

Our Top Recommendation: JotForm

For most organizations, JotForm is our go-to recommendation for WordPress forms.

JotForm is a hosted form platform, which means your form data never touches your WordPress server. Submissions are stored and processed on JotForm’s own secure infrastructure, which includes HTTPS encryption in transit, GDPR compliance tools, HIPAA-compliant plans for healthcare-related data, and built-in spam protection. You simply embed the form on your WordPress page using a shortcode or their official plugin. It’s clean, simple, and secure.

JotForm also offers a generous free tier with paid plans available as your needs grow. It’s a mature, well-supported platform that doesn’t require your web team to manage encryption, database security, or plugin updates to keep form data safe. All you have to do is set and remember a strong password.

Best for: Most businesses, nonprofits, and organizations collecting contact info, applications, registrations, or general inquiries.

If You’re on Microsoft 365: Microsoft Forms

If your organization already uses Microsoft 365, you may have a secure form solution sitting right in your existing toolkit in Microsoft Forms.

Microsoft Forms is included with most Microsoft 365 business and enterprise subscriptions. Data collected through Microsoft Forms is stored within your organization’s Microsoft 365 tenant, subject to the same compliance and security controls as your other Microsoft data (including data residency, retention policies, and admin oversight). For organizations already operating within the Microsoft ecosystem, this can be an excellent fit.

The good news for WordPress users: Microsoft Forms can be embedded directly on a WordPress page using an iframe embed code generated from the form itself. It won’t win any design awards, but it’s functional, familiar to your staff, and backed by enterprise-grade infrastructure you’re likely already paying for.

Best for: Organizations already running Microsoft 365 who want to minimize third-party vendor footprint.

What is PII?

If you’re unsure what is considered PII and what is safe to collect and store unencrypted, the short answer is: it varies. You’re subject to the rules of the place the user lives, not your state. So, it’s important to understand basic PII rules for your country or the country in which you’re doing business.

Other Secure Form Options Worth Considering

Depending on your needs, a few other platforms are worth a look:

Typeform — A polished, user-friendly hosted form platform similar to JotForm. Data is stored on Typeform’s servers (not your WordPress site), with HTTPS encryption and GDPR tools built in. The conversational form style can improve completion rates. Embeds easily in WordPress.

Cognito Forms — A solid mid-tier option with strong encryption features, including support for encrypted entries. HIPAA-compliant plans are available. Embeds in WordPress via iframe or their plugin.

Tally — A newer, lightweight option based in Belgium that’s gaining traction. Free tier is generous, data is stored off-site, and it embeds cleanly in WordPress. Worth considering for simpler use cases.

Formstack — An enterprise-grade option with strong compliance credentials (HIPAA, SOC 2). Better suited for larger organizations with more complex data handling requirements.

What We Do NOT Recommend: Gravity Forms (Without Additional Safeguards)

When we build sites, we use Gravity Forms for the contact form. It is one of the most widely used WordPress form plugins.

By default, Gravity Forms stores all form submissions directly in your WordPress database, unencrypted. That means every contact form submission, every application, every message someone sends through your site lives in plaintext in your database. If your WordPress site is ever compromised, whether through a plugin vulnerability, a weak password, a misconfigured server, or any number of common attack vectors, that data is exposed.

For forms collecting anything beyond the most basic, low-sensitivity information, this is not an acceptable risk. There are third-party add-ons that can add encryption to Gravity Forms, but this introduces additional complexity, cost, and maintenance overhead that most site owners aren’t equipped to manage reliably.

Our recommendation is to avoid Gravity Forms for any form that collects personal, financial, health-related, or otherwise sensitive information. The risk simply isn’t worth it when better alternatives exist. It’s safer to keep your sensitive data stored outside of your WordPress installation.

The Bottom Line

When evaluating a form solution for your WordPress site, the key question to ask is: where does the data go, and how is it protected?

Hosted platforms like JotForm, Microsoft Forms, Typeform, and Cognito Forms keep data off your WordPress server entirely, reducing your attack surface and putting data security in the hands of vendors whose core business is exactly that. Solutions that store data directly in your WordPress database put the burden of security squarely on you, and that’s a burden most sites aren’t set up to carry.

When in doubt, reach out to your web team, IT provider, and/or solicitor before collecting sensitive data through any form. A few minutes of due diligence upfront can save significant headaches down the road.