Every WordPress form tutorial starts with "first, install a plugin". You don't need one. A form plugin is another thing to update, another thing slowing your site down, and — as WordPress security history keeps showing — a favorite way in for attackers. A plain HTML form pasted into one block does the same job with nothing to maintain.
Open the free hform builder, add the fields you want, and press Finish. Tell it where messages should go and you get a small block of HTML with the delivery address already filled in — plus a link to the form's own hosted page. No signup to build; you claim your messages by email when you're ready.
<form action="https://hform.com/s/your-form-id" method="POST">
<label for="name">Name</label>
<input id="name" name="name" required>
<label for="email">Email</label>
<input id="email" name="email" type="email" required>
<label for="message">Message</label>
<textarea id="message" name="message" required></textarea>
<button>Send</button>
</form>(The real HTML from the builder also includes an invisible honeypot field that catches spam bots, and a small optional stylesheet.)
Edit your page in WordPress, click + where you want the form, and search for the Custom HTML block. It's built into the editor — no plugin involved.
Paste the form HTML into the block. The block's Preview tab shows the form as visitors will see it. Update or publish the page.
Open the published page and submit the form once yourself. When it works, a submission shows your visitor a clean thank-you page (or any page you choose), and the message lands in your email inbox with reply-to set to the sender — answer it like any other email. A copy stays in your hform inbox, downloadable as a spreadsheet.
Form plugins earn their keep when you need things HTML can't do alone: multi-step forms with conditional logic, payments inside the form, or entries managed inside wp-admin. For a contact, quote or booking-request form, they're overkill — and every plugin you skip is one less update and one less attack surface.
Form submissions are personal data. If EU residents can submit your form, GDPR expects you to say near the form what the data is used for, ask only for what you need, and delete what you no longer use. With hform your messages are stored in the EU (Sweden) with automatic retention limits — and a one-line privacy note under the form ("We use your details only to reply to your message") covers the common small-business case. The full picture, without legalese: GDPR and web forms in plain language.
Yes. The Custom HTML block is available on WordPress.com, and the form needs no code running on your site — the browser sends messages straight to hform’s EU server.
The generated HTML is clean, semantic markup, so it inherits your theme’s fonts and colors. The builder also includes a small optional stylesheet you can keep or delete.
The HTML includes an invisible honeypot field that catches crude bots, and spam never counts against your quota. If real spam gets through, a captcha can be switched on for your form’s hosted page.
The hform builder gives you clean, accessible form HTML with delivery wired in — press Finish and paste it into WordPress with the steps above. Free plan included; honest pricing if you outgrow it.
More platforms: Shopify · Wix · Squarespace · Webflow · Static sites — or see all guides.