Reference
Global settings
Every setting on the Settings screen.
Settings that apply to every form, in Forms, Settings. Credentials (API keys, secrets and tokens) are stored encrypted and shown only as their last characters.
Email
| Setting | Kind | Default | Notes |
|---|
| Default recipient | Text | admin@localhost.com | Used by {settings:default_recipient} in notifications. |
|---|
| Sender name | Text | My WordPress Website | |
|---|
| Sender address | Text | wordpress@127.0.0.1 | Use an address on this site's domain. Many hosts refuse to send mail from other domains. |
|---|
defaults
| Setting | Kind | Default | Notes |
|---|
| Form language when a form does not choose one | Language | | A WordPress locale such as en_GB, ar or ur. Empty follows the site language. Used for dates, numbers and built in messages. |
|---|
| How dates are shown in entries, emails and exports | Choice: The WordPress date format, DD/MM/YYYY, MM/DD/YYYY, YYYY-MM-DD, DD.MM.YYYY, Long (12 October 2026) | The WordPress date format | Date fields set to "From the form language" use this. A date field can still choose its own format. |
|---|
| New forms store their entries | On or off | On | Each form can change this in its Privacy settings. |
|---|
Privacy
| Setting | Kind | Default | Notes |
|---|
| IP addresses in new entries | Choice: Store in full, Store shortened, Do not store | Store shortened | |
|---|
| Custom fields that merge tags may read | List, one per line | | For {page:meta:key} and {user:meta:key}, one key per line. Empty allows any key except hidden ones (starting with an underscore) and ones that look like passwords, tokens or keys. |
|---|
| Trusted proxy addresses | List, one per line | | Only when the site is behind a proxy or CDN that sets X-Forwarded-For. Cloudflare is detected automatically. |
|---|
Files
| Setting | Kind | Default | Notes |
|---|
| File links in emails stay valid for (days) | Whole number | 7 | |
|---|
| File links in emails require logging in | On or off | Off | |
|---|
Entries
| Setting | Kind | Default | Notes |
|---|
| Entry statuses | List, one per line | New, In review, Approved, Rejected, Waitlist | |
|---|
Interface
| Setting | Kind | Default | Notes |
|---|
| Forms menu in the admin bar | On or off | On | |
|---|
| Dashboard widget | On or off | On | |
|---|
| Insert form button in the classic editor | On or off | On | |
|---|
| "Edit form" link under forms for staff | On or off | On | |
|---|
| Always load form styles on these pages (ids or paths) | List, one per line | | Only for themes or page builders that print forms after the page head. |
|---|
| Custom CSS for every form | CSS | | |
|---|
| Run custom JavaScript added to forms | On or off | Off | Off by default. Only administrators who may post unfiltered HTML can add it to a form. |
|---|
Payments
| Setting | Kind | Default | Notes |
|---|
| Payments | Choice: Test mode, Live | Test mode | |
|---|
| PayPal client id (sandbox) | Text | | |
|---|
| PayPal client id (live) | Text | | |
|---|
| PayPal webhook id (sandbox) | Text | | |
|---|
| PayPal webhook id (live) | Text | | |
|---|
Spam protection
| Setting | Kind | Default | Notes |
|---|
| reCAPTCHA site key | Text | | |
|---|
| hCaptcha site key | Text | | |
|---|
| Turnstile site key | Text | | |
|---|
| When the challenge service cannot be reached | Choice: Refuse the entry, Accept it and mark it as spam for review | Refuse the entry | |
|---|
Integrations
| Setting | Kind | Default | Notes |
|---|
| Private network addresses that webhooks may call | List, one per line | | Host names or IP ranges, one per line. Requests to private, local and reserved addresses are blocked unless listed here. |
|---|
| When the email verification service cannot be reached | Choice: Accept the address, Ask the visitor to try again | Accept the address | |
|---|
| Google Maps Platform key (address suggestions) | Text | | |
|---|
Data
| Setting | Kind | Default | Notes |
|---|
| Personal data erasure requests (Tools, Erase Personal Data) | Choice: Remove personal answers and keep the rest of the entry, Delete the whole entry | Remove personal answers and keep the rest of the entry | |
|---|
| Protect spreadsheet exports against formula injection | On or off | On | Answers that start with =, +, - or @ get a leading apostrophe so spreadsheet programs show them as text. |
|---|
| Delete all Flavonto Forms data when the plugin is deleted | On or off | Off | Forms, entries, files and settings are removed for good. Deactivating never deletes anything. |
|---|
| Plugin log | Choice: Errors, Warnings, Everything | Warnings | |
|---|
| Show imported forms for old [quform] shortcodes | On or off | Off | |
|---|
Credentials
| Credential |
|---|
| Stripe secret key (test) |
| Stripe secret key (live) |
| Stripe webhook signing secret (test) |
| Stripe webhook signing secret (live) |
| PayPal secret (sandbox) |
| PayPal secret (live) |
| reCAPTCHA secret key |
| hCaptcha secret key |
| Turnstile secret key |
| Mailchimp API key |
| MailerLite API token |
| ActiveCampaign API key |
| ActiveCampaign API address |
| GetResponse API key |
| Campaign Monitor API key |
| Mailrelay API key |
| Mailrelay account address |
| Zoho client id |
| Zoho client secret |
| Zoho refresh token |
| Zoho data centre |
| QuickEmailVerification API key |
| Telegram bot token |
| Licence key |