After sending
Integrations
Webhooks, email marketing services, Zoho CRM, Telegram, WordPress users and posts, database rows, analytics events, campaign values and address suggestions.
Integrations run after the entry is stored, in the background, like emails. Each one can have a condition (Only run when), and failures are retried with increasing waits. Every attempt shows in the entry's timeline, and you can run an integration again from the entry.
Account details (API keys and tokens) are entered once in Settings, Integrations, where each service has a Test the connection button. They are stored encrypted. Each form then adds integrations in its Integrations tab and chooses lists, tags and field mapping.
Every email marketing integration has Only when this consent field is ticked. Use it so people are only added to a list when they agreed.
Each integration in the form's Integrations tab shows its last result: completed, failed or waiting to retry, how long ago, for which entry, and the service's answer. Outbound requests carry an X-Flvf-Correlation header with an id that also appears in the entry, so a receiving service's logs can be matched to the entry's timeline.
Webhooks
Sends the entry to any web address as JSON or form data.
| Setting | Notes |
|---|---|
| Service | Presets for Zapier, Make, n8n, Google Sheets and Formstack Documents fill sensible defaults and show where to find the address |
| Address, method, body | POST or PUT, JSON or form encoded |
| Data to send | All fields by their field names, or only the fields you map, plus extra fixed values and entry details |
| Headers and authentication | A bearer token or a user name and password, and any other headers you need; secrets are stored encrypted |
| Signing secret | Adds an X-Flvf-Signature header (time stamp and HMAC SHA-256 of the body) so the receiver can check the request came from your site |
| Timeout | Seconds to wait for a reply |
Send a sample sends the newest entry of the form (or sample answers when there are no entries yet) to the webhook now, so you can map fields in Zapier, Make or n8n before the first real entry arrives. The result shows the status the receiving service answered with. Samples are not recorded in any entry.
For safety, webhooks only call public addresses. Addresses on your own network (for example localhost, 192.168.x.x or other private ranges) are refused unless you list them in Settings, Integrations, Private network addresses that webhooks may call. Redirects are followed at most three times and checked again each time.
Google Sheets: create a Google Apps Script web app on your sheet that appends a row from the posted JSON, deploy it with access for anyone, and paste its address into a webhook with the Google Sheets preset. A ready script is in Recipes.
Email marketing and CRM services
| Service | What you choose per form |
|---|---|
| Mailchimp | Audience, email field, merge fields, groups, tags, double opt-in, update existing members |
| ActiveCampaign | List, email, first and last name, phone, custom fields, tags |
| Campaign Monitor | List, email, name, mobile, custom fields, consent to track, resubscribe |
| GetResponse | List, email, name, custom fields, tags, autoresponder day |
| MailerLite | Groups, email, fields, status of new subscribers |
| Mailrelay | Groups, email, name, custom fields |
| Zoho CRM | Lead or contact, field mapping by Zoho API names, update when the email exists, run Zoho workflow rules |
Lists, groups and tags are loaded from your account when you open the integration, so you pick them by name.
Zoho CRM needs a client id, client secret and refresh token from a Zoho "self client", and your Zoho data centre. Recipes shows the steps.
Plugins on your site
| Plugin | Notes |
|---|---|
| MailPoet | Lists, names, custom fields, MailPoet's confirmation email, welcome emails |
| Newsletter | Public lists, names, opt-in type |
| Mailster | Lists, fields, double opt-in, update existing subscribers |
These appear when the plugin is active.
Telegram
Sends a message to a chat or channel through your own Telegram bot. Enter the bot token in Settings and the chat id in the form (a number, or @channelname for public channels). The message can use merge tags.
WordPress actions
| Action | Notes |
|---|---|
| Create a user account | Email, user name and password fields (or a random password with a link to set one), names, website, role, user meta, BuddyPress profile fields when BuddyPress is active, WordPress's own emails, and logging the new user in. Roles that can manage users, plugins or settings can never be given, and user meta keys used for permissions are refused |
| Log in | User name or email field, password field, and a remember me field. Wrong details get one message that does not say which part was wrong, and repeated failures are slowed down |
| Log out | Logs the visitor out when the form is sent |
| Create a post | Post type, status (pending review is safer for public forms), title, content, excerpt, author, categories, tags and other terms, custom fields and a featured image from an upload field |
| Database table | Adds a row to a table in the site database or another MySQL or MariaDB database, with columns mapped from answers |
The Database table action is only available to administrators. WordPress core tables, WooCommerce tables and Flavonto Forms tables are refused. In Update that row mode, the key value must be either a hidden field whose value comes from a signed link, or the logged in user ({user:id}), so visitors cannot change which row is updated. Make signed links in the hidden field's settings, or in PHP with flavonto_signed_url().
Analytics and campaign tracking
The plugin loads no analytics code. When your site already has Google Tag Manager or Google Analytics (gtag), a form can report to it: in the form's settings, Analytics group, turn on Send events to Google Analytics or Tag Manager.
| Setting | Notes |
|---|---|
| Send to | dataLayer (Tag Manager), gtag, or both |
| Event name for a successful submission | form_submit by default; sent with the form id and the entry reference |
| Also send form start and step events | form_start when the visitor first types or chooses something, and form_step with the step number each time a step is shown |
| Google Ads conversion | An AW-XXXX/label value sends a conversion when an entry is sent (never on start or step events) |
To keep where a visitor came from, add a Hidden value field and set Value to one of the campaign sources: utm_source, utm_medium, utm_campaign, utm_term, utm_content, the Google Ads click id (gclid), First site the visitor came from or First page the visitor saw. The browser remembers them, for that browser tab only, from the first page with such a form that the visitor opened, so a visitor who arrives on a campaign link and moves to the contact page keeps the campaign. They are sent only for the fields that ask for them. Pages whose forms have no such field neither keep nor send any of them. First page the visitor saw therefore means the first page with such a form; pages without a form do not load the plugin's script. The page the visitor came from just before the form is available as {referrer} when the form stores it.
Visitor country (another hidden value source) is the two letter country code from Cloudflare's CF-IPCountry header, used only when the request really comes through Cloudflare, or from the GeoIP Detection plugin when it is active. Developers can supply it with the flvf_visitor_country filter.
Address suggestions and a map
An Address field can suggest addresses as the visitor types, using Google Places. Add a Google Maps Platform key in Settings, Integrations, then turn on Suggest addresses with Google Places in the field's Advanced settings. Choosing a suggestion fills the street, town, region, postal code and country boxes, which stay editable.
Let visitors pick the location on a map adds a map with a pin. Moving the pin looks the address up again and fills the boxes, and the chosen point is stored with the address as latitude and longitude. The map is an extra: every part of the address can still be typed, which is also the way to enter it with a keyboard or a screen reader.
Google's script is loaded only when a visitor moves into an address field that uses suggestions, never on other pages or forms. While it is used, Google receives what the visitor types in that field and their IP address, so mention Google Maps Platform in your privacy policy.