Forms
98 hooks fired by Forms: 84 filters and 14 actions across 104 call sites.
98 hooks fired by Forms: 84 filters and 14 actions across 104 call sites. 99 of the 104 call sites are described by a docblock, at the call or on the constant that names the hook; the rest are listed with their signature and call sites only. Paths are relative to the plugin directory.
wp_handle_upload_prefilter
Filter · 1 argument · 1 call site
apply_filters( 'wp_handle_upload_prefilter', $file )Fired from:
packages/Forms/core/base/Uploader.php:672
wp_react_settings_shared_context_initial_values
Filter · 1 argument · 1 call site
Filters the shared context given to controls on the Forms settings tab.
This is the same filter the standalone settings page fires. Add-ons put connection state and other shared values here; firing it on both mounts keeps their controls populated whichever settings screen is open.
applyFilters( 'wp_react_settings_shared_context_initial_values', {} )initialValues(Object) — Shared context values. Default empty object.
Fired from:
assets/packages/forms/admin/screens/Settings.js:228
xpac-forms-after-settings-modal-content
Filter · 3 arguments · 3 call sites
Content appended inside a settings panel's item modal.
applyFilters( 'xpac-forms-after-settings-modal-content', [], { value: options, onChange: onUpdate, }, 'xpac-forms-email-notification' )
applyFilters( 'xpac-forms-after-settings-modal-content', [], { value: options, onChange: onUpdate, }, 'xpac-forms-messages' )
applyFilters( 'xpac-forms-after-settings-modal-content', [], { value: options, onChange: onUpdate, }, 'xpac-forms-redirect' )Fired from:
assets/packages/forms/form/sidebars/Settings/Panels/EmailNotification/Modal.js:194assets/packages/forms/form/sidebars/Settings/Panels/Messages/Modal.js:55assets/packages/forms/form/sidebars/Settings/Panels/Redirect/Modal.js:51
xpac-forms-field-name
Filter · 3 arguments · 1 call site
The name generated for a newly inserted field block.
applyFilters( 'xpac-forms-field-name', randomName, blockAttributes, { postId, isNewPost, prefix, } )Fired from:
assets/packages/forms/blocks/shared/HOCs/WithRandomName.js:34
xpac-forms-field-output-props
Filter · 4 arguments · 1 call site
The props a field block renders its control with.
applyFilters( 'xpac-forms-field-output-props', { blockProps: {}, fieldProps: {}, }, blockName, attributes, isEditor )Fired from:
assets/packages/forms/hooks/useFieldOutputProps.js:6
xpac-forms-field-panels
Filter · 2 arguments · 1 call site
Panels added to a field block's inspector.
applyFilters( 'xpac-forms-field-panels', [], blockName )Fired from:
assets/packages/forms/hooks/useFieldPanels.js:7
xpac-forms-form-panels
Filter · 1 argument · 1 call site
Panels added to the form editor's Settings sidebar.
applyFilters( 'xpac-forms-form-panels', initialPanels )Fired from:
assets/packages/forms/hooks/useFormPanels.js:69
xpac-forms-inner-field
Filter · 2 arguments · 1 call site
The field a wrapper block renders, as { name, attributes }, or null.
applyFilters( 'xpac-forms-inner-field', null, block )Fired from:
assets/packages/forms/blocks/shared/utils.js:63
xpac_agent_tool_enabled
Filter · 2 arguments · 2 call sites
Filters whether one XPAC tool may register as an ability.
XPAC Agent answers from its Tools switches at priority 1; while Agent is inactive nothing registers.
apply_filters( 'xpac_agent_tool_enabled', false, self::NAMESPACE . '/' . $name )
apply_filters( 'xpac_agent_tool_enabled', false, 'xpac-wp/create-content' )$enabled(bool) — Default false.$name(string) — The full ability name, such asxpac-forms/create-form.
Returns bool — Whether the tool may register.
Fired from:
packages/Forms/core/base/Abilities/Abilities.php:124packages/Forms/core/base/Abilities/Abilities.php:242
xpac_form_post_{$block['blockName']}_upload
Action · Dynamic name · 4 arguments · 1 call site
Fires once every file in one field has been dealt with, refused ones included.
The variable part is the field's block name. Remove here any filters
added on xpac_form_pre_{$blockName}_upload. It fires before the refusals
in $results become submission errors (see xpac_forms_upload_errors),
and it cannot change which files are refused.
do_action( "xpac_form_post_{$block['blockName']}_upload", $block, $results, $maxSize, $limit )$block(array) — Parsed block for the field that was uploaded for.$results(array) — One entry per attempted file, each of them ['upload' => array, 'error' => string|null, 'data' => ['id' => int, 'file' => array]|null].$maxSize(int) — Per-file size cap in bytes. 0 for no cap.$limit(int) — Maximum number of files. 0 for no limit.
Fired from:
packages/Forms/core/base/Uploader.php:730
xpac_form_pre_{$block['blockName']}_upload
Action · Dynamic name · 4 arguments · 1 call site
Fires before one field's files are handed to wp_handle_upload().
The variable part is the field's block name: xp/form-field-file, or an
add-on block whose field type is file. Fires once per field that received
files, after validation has passed and before the entry is stored. Filters
added here, such as upload_dir, should be removed on the matching
xpac_form_post_{$blockName}_upload action.
do_action( "xpac_form_pre_{$block['blockName']}_upload", $block, $upload, $maxSize, $limit )$block(array) — Parsed block for the field being uploaded for.$upload(array) — Files about to be stored, already cut to $limit.$maxSize(int) — Per-file size cap in bytes. 0 for no cap.$limit(int) — Maximum number of files. 0 for no limit.
Fired from:
packages/Forms/core/base/Uploader.php:582
xpac_form_upload_{$block['blockName']}_attachment_post_status
Filter · Dynamic name · 2 arguments · 1 call site
Filters the status a submitted file is stored with.
The variable part is the field's block name. "private" keeps uploads out of the public media listing; "inherit" shows them in the media library to every role.
apply_filters( "xpac_form_upload_{$block['blockName']}_attachment_post_status", 'private', $block )$postStatus(string) — Attachment post status.$block(array) — Parsed block the files were posted for.
Returns string — Attachment post status.
Fired from:
packages/Forms/core/base/Uploader.php:618
xpac_form_upload_{$block['blockName']}_insert_wp_attachment
Filter · Dynamic name · 5 arguments · 1 call site
Filters whether stored files get an attachment record of their own.
The variable part is the field's block name. With false the bytes are still stored, but the entry records no id and a refused submission's cleanup cannot delete them, so the listener must take ownership.
apply_filters( "xpac_form_upload_{$block['blockName']}_insert_wp_attachment", true, $block, $upload, $maxSize, $limit )$insertWpAttachment(bool) — Whether to create attachments. Default true.$block(array) — Parsed block for the field being uploaded for.$upload(array) — Files about to be stored.$maxSize(int) — Per-file size cap in bytes. 0 for no cap.$limit(int) — Maximum number of files. 0 for no limit.
Returns bool — Whether to create an attachment for each file stored for this field.
Fired from:
packages/Forms/core/base/Uploader.php:598
xpac_form_upload_{$block['blockName']}_parent_post_id
Filter · Dynamic name · 1 argument · 1 call site
Filters the post a submitted file is attached to.
The variable part is the field's block name. The parent does not grant access to a "private" attachment. Return 0 to leave it unattached.
apply_filters( "xpac_form_upload_{$block['blockName']}_parent_post_id", $this->getFormId() )$parentPostId(int) — Post id to attach to. Default: the form's id.
Returns int — Post id to attach to, or 0 for none.
Fired from:
packages/Forms/core/base/Uploader.php:634
xpac_forms_abilities
Filter · 1 argument · 1 call site
Filters which Forms abilities are registered for AI agents.
Asked when the Abilities API first registers abilities. Names are the part after xpac-forms/.
A name left out is not registered at all, so no REST route, MCP server or WordPress AI feature can
call it. Agent's chat and MCP server still offer only what Agent's own switches allow.
apply_filters( 'xpac_forms_abilities', $allowed )$abilities(string[]) — Ability names. Default the ones XPAC Agent's switches allow.
Returns string[] — Ability names to register; unknown names are ignored.
Fired from:
packages/Forms/core/base/Abilities/Abilities.php:140
xpac_forms_ability_field_types
Filter · 1 argument · 1 call site
Filters the field types the AI form builder offers, and the block each one writes.
Forms' own types cannot be changed or removed. An added type is a lowercase word of up to 32
characters, hyphens allowed, naming a block such as xp/form-field-..., and is refused while that
block is not registered.
apply_filters( 'xpac_forms_ability_field_types', $types )$types(array<string, string>) — Type => block name.
Returns array<string, — string> Type => block name.
Fired from:
packages/Forms/core/base/Abilities/Fields.php:220
xpac_forms_ability_field_warnings
Filter · 2 arguments · 1 call site
Filters what an agent is told about the fields it just added to a form.
Runs for create-form and add-field. Empty, repeated and non-string warnings are dropped.
apply_filters( 'xpac_forms_ability_field_warnings', $warnings, array_map(static fn($field): array => (array) $field, array_values($fields)) )$warnings(string[]) — Warnings so far, a sentence or two each.$fields(array<int, array<string, mixed>>) — The fields as the call described them.
Returns string[] — Warnings to show the agent, one plain sentence or two each.
Fired from:
packages/Forms/core/base/Abilities/Handlers.php:1705
xpac_forms_action_item_status
Filter · 4 arguments · 1 call site
Filters whether one configured item runs for this submission.
Asked once per item while a submission is processed, for notification emails, integration actions, redirects and messages. False drops the item, which counts as switched off, not as a failure. Conditional Logic uses this to apply per-item conditions.
apply_filters( 'xpac_forms_action_item_status', $status, $item, $externalSubmission, $module )$status(bool) — Whether the item runs. Defaults to its storedstatus, or true; false when it has a condition nothing can check.$item(array) — The stored item.$submission(Submission) — Callback-safe submission without write-only answers.$module(string) — Panel asking: "xpac-forms-email", "xpac-forms-redirect", "xpac-forms-messages", or an add-on's module id.
Returns bool — Whether the item runs.
Fired from:
packages/Forms/core/base/Utils.php:78
xpac_forms_admin_form_badges
Filter · 2 arguments · 1 call site
Filters the badges a form shows after its #id in Forms › All Forms.
Each badge has a label (required), an intent (default, info, success, warning or error; anything
else reads as info), and an optional url (makes it a link) and title (tooltip). Text is sanitised,
URLs escaped, badges without a label skipped, and at most three are shown.
apply_filters( 'xpac_forms_admin_form_badges', [], $post )$badges(array) — Badges for this form. Default empty array.$form(WP_Post) — The form post.
Returns array — Badges, each an array with label, intent, url and title.
Fired from:
packages/Forms/core/base/Admin/Rest.php:600
xpac_forms_admin_moved_settings_pages
Filter · 1 argument · 1 call site
Filters the Forms settings pages that moved to another screen.
A moved page is hidden from Forms › Settings and its old URLs redirect (302) to the given URL. Its fields stay registered, so saved values and saving are unchanged. Names go through sanitize_key(); an entry without a URL string is dropped.
apply_filters( 'xpac_forms_admin_moved_settings_pages', [] )$moved(array) — Settings page name => admin URL. Default empty array.
Returns array — Settings page name => admin URL.
Fired from:
packages/Forms/core/base/MenuPage.php:76
xpac_forms_after_form_begin
Action · 3 arguments · 1 call site
Fires just inside the opening <form> tag.
Output goes before the fields and is submitted with the form, as hidden inputs are.
do_action( 'xpac_forms_after_form_begin', $post, $block, $settings )$post(WP_Post) — The form being rendered.$block(WP_Block) — The form block instance on the page.$settings(FormSettings) — The form's stored settings.
Fired from:
packages/Forms/core/base/Blocks.php:1282
xpac_forms_after_submit
Action · 1 argument · 1 call site
Fires when a submission has been accepted.
Throttling, validation, uploads and pre-submit callbacks have passed. Logger stores the entry at priority 10 and Dispatcher queues integrations at priority 20. A callback that throws after the entry is stored is logged, and the visitor still sees success.
do_action( 'xpac_forms_after_submit', $this )$submission(Submission) — The accepted submission.
Fired from:
packages/Forms/core/base/Submission.php:1904
xpac_forms_agent_conditional
Filter · 1 argument · 1 call site
Filters whether the Forms agent tools offer show_if on a field.
Conditional Logic returns true; return false to switch show_if off in the tools. While it is false, create-form, add-field and update-field take no show_if, get-form describes no conditions, and a condition does not stop a field being renamed or removed. Conditions already saved in a form are enforced either way.
apply_filters( 'xpac_forms_agent_conditional', false )$conditional(bool) — Default false.
Returns bool — Whether the tools offer show_if.
Fired from:
packages/Forms/core/base/Abilities/Fields.php:455
xpac_forms_agent_deliveries
Filter · 1 argument · 1 call site
Filters the integration add-ons an agent can connect a form to.
Keyed by a name of lowercase letters, digits and dashes. Each descriptor carries label,
description, meta_key (the panel whose items hold the connections), process (the
submit callback on xpac_forms_submit_callbacks), targets (list, url or none),
literals, options (name to {type, values?, description?, default?, secret?}, with
values only on enum and list) and the callables connected, list, build and
describe. describe returns the real target, URLs included: core masks URL targets.
An invalid descriptor is dropped with a notice. Register it from the add-on's constructor; the
callables run at tool time and may rely on statics set on xpac_forms_init.
See packages/Forms/README.md.
apply_filters( 'xpac_forms_agent_deliveries', [] )$deliveries(array<string, array<string, mixed>>) — Default none.
Returns array<string, — array<string, mixed>> Descriptors, keyed by name.
Fired from:
packages/Forms/core/base/Abilities/Deliveries.php:84
xpac_forms_agent_protections
Filter · 1 argument · 1 call site
Filters the spam protection add-ons an agent can switch on a form.
Keyed by a name of lowercase letters, digits and dashes. Each entry carries label,
meta_key (the panel whose enable is the switch) and configured, a callable returning
true or one sentence naming what is missing and where it is set. A protection that reads form
fields adds fields: key, its panel key mapping roles to field names, and roles, each role
(lowercase letters, digits and underscores) with its label. An invalid entry is dropped with a
notice. Register it from the add-on's constructor; configured may rely on init statics.
apply_filters( 'xpac_forms_agent_protections', [] )$protections(array<string, array<string, mixed>>) — Default none.
Returns array<string, — array<string, mixed>> Protections, keyed by name.
Fired from:
packages/Forms/core/base/Abilities/Settings.php:167
xpac_forms_agent_tools
Filter · 1 argument · 1 call site
Filters the tools add-ons add to the Forms group of XPAC Agent.
Keyed by a name of lowercase letters, digits and dashes, registered as xpac-forms/<name>.
Each entry needs label, tool_label (Tools screen), description, input_schema,
execute_callback and permission_callback, and may add tool_description (one sentence for
the Tools screen), output_schema, annotations (readonly, destructive, idempotent) and
instructions, whose first line is added to the agent's instructions while the tool is on.
An entry missing a required key, or reusing a Forms tool name, is skipped with a notice.
Bind it in the add-on's constructor, since the abilities registry may be built before init.
See packages/Forms/README.md.
apply_filters( 'xpac_forms_agent_tools', [] )$tools(array<string, array<string, mixed>>) — Default none.
Returns array<string, — array<string, mixed>> Tool definitions, keyed by name.
Fired from:
packages/Forms/core/base/Abilities/Abilities.php:881
xpac_forms_before_form_end
Action · 3 arguments · 1 call site
Fires just before the closing </form> tag.
Output goes after the fields and is submitted with the form.
do_action( 'xpac_forms_before_form_end', $post, $block, $settings )$post(WP_Post) — The form being rendered.$block(WP_Block) — The form block instance on the page.$settings(FormSettings) — The form's stored settings.
Fired from:
packages/Forms/core/base/Blocks.php:1320
xpac_forms_deliveries_retention_days
Filter · 1 argument · 1 call site
Filters how many days a successful delivery record is kept for.
Applies to sent and skipped records only; a failed or pending delivery is never
pruned. Zero or less turns history pruning off; retry payloads are still removed
after 30 days.
apply_filters( 'xpac_forms_deliveries_retention_days', $days )$days(int) — Days to keep. Default 30, or the site's setting.
Returns int — Days to keep; 0 or less keeps them forever.
Fired from:
packages/Forms/core/deliveries/Retention.php:105
xpac_forms_disable_default_styles
Filter · 1 argument · 1 call site
Filters whether the form block's own stylesheet is dropped entirely.
True overrides every other setting and removes the stylesheet and the shipped
style defaults everywhere, wp-admin included. The theme.json or Styles panel
opt-out (settings.custom.xp-form.defaultStyles) only affects the front end.
Read when the form block registers, so add the callback before xpac_forms_init.
apply_filters( 'xpac_forms_disable_default_styles', false )$disabled(bool) — Whether to drop the default styles. Default false.
Returns bool — Whether to drop the default styles.
Fired from:
packages/Forms/core/base/GlobalStyles.php:54
xpac_forms_dynamic_select_options_limit
Filter · 2 arguments · 1 call site
Filters how many options a Dynamic Select source lists.
Applies to both the printed options and validation of the submitted value.
apply_filters( 'xpac_forms_dynamic_select_options_limit', self::OPTIONS_LIMIT, $dataSource )$limit(int) — Most options listed, or 0 for all of them. Default 0.$dataSource(array) — The field's dataSource attribute.
Returns int — Most options listed, or 0 for all of them.
Fired from:
packages/Forms/core/base/Blocks/DynamicSelect.php:217
xpac_forms_editor_inline_js_data
Filter · 1 argument · 1 call site
Filters the data the form editor reads as window.xpacForms.
Printed before the form settings script. A non-array return is cast to one.
The keys Forms owns (validationMessages, submissionMessages,
settingsDefaults, registeredBlocksConfig, phoneField) are merged in
afterwards and cannot be replaced here.
apply_filters( 'xpac_forms_editor_inline_js_data', [ 'presets' => [] ] )$data(array) — Editor data. Default['presets' => []].
Returns array — Editor data.
Fired from:
packages/Forms/core/base/PostType.php:457
xpac_forms_email_content_type
Filter · 3 arguments · 1 call site
Filters whether one notification is sent as HTML or as plain text.
With "html", submitted values are escaped, {{ALL_FIELDS}} becomes a table and the
body is passed through wp_kses_post(). Anything else sends plain text.
apply_filters( 'xpac_forms_email_content_type', (string) ($item['contentType'] ?? 'text'), $item, $externalSubmission )$type(string) — "text" or "html", from the item's storedcontentType.$item(array) — The notification's stored settings.$submission(Submission) — Submission being mailed.
Returns string — "html" to send HTML; any other value sends plain text.
Fired from:
packages/Forms/core/base/Email.php:492
xpac_forms_email_field_value
Filter · 4 arguments · 1 call site
Filters a submitted field's value as the email prints it.
The result replaces the field's {{name}} in the subject, message and address
lines, and its row in {{ALL_FIELDS}}. Runs once per field for each notification.
Not applied to checklist, dropdown, radio and file fields, printed as
labels or URLs, or to confirmation and password fields, never mailed.
A dynamic select prints its option labels unless this changes the value.
apply_filters( 'xpac_forms_email_field_value', $data_value, $type, $key, $externalSubmission )$data_value(mixed) — The submitted value.$type(string) — Field type, as Blocks::getFieldTypeByBlock() reports it.$key(string) — Field name, the same one the {{variable}} uses.$submission(Submission) — Submission being mailed.
Returns mixed — Value to print, as text: a scalar as itself, an array's scalar members joined with ", ", anything else as nothing.
Fired from:
packages/Forms/core/base/Email.php:429
xpac_forms_email_headers
Filter · 3 arguments · 1 call site
Filters the headers one notification is sent with.
From, MIME-Version and Content-Type, then any Reply-To, Cc and Bcc. The return replaces the list.
apply_filters( 'xpac_forms_email_headers', $headers, $item, $externalSubmission )$headers(string[]) — Header lines, each ending in CRLF.$item(array) — The notification's stored settings.$submission(Submission) — Submission being mailed.
Returns string[] — Header lines to send, each ending in CRLF; null sends none.
Fired from:
packages/Forms/core/base/Email.php:605
xpac_forms_entries_delete_attachments
Filter · 3 arguments · 1 call site
Whether the files a deleted submission carried are deleted with it.
Fires once per form whenever submissions are deleted for good: by hand, by retention or with their form. Even when true, only attachments still parented to the form and not used by another of its submissions, a featured image or a public custom field are deleted. Return false to keep them, for example when other plugins reuse uploaded files.
apply_filters( 'xpac_forms_entries_delete_attachments', true, $form_id, $entry_ids )$delete(bool) — Whether to delete the attachments. Default true.$form_id(int) — The form post ID.$entry_ids(int[]) — Entries about to be deleted.
Returns bool — Whether to delete the attachments.
Fired from:
packages/Forms/core/entries/Cleaner.php:483
xpac_forms_entries_entry_data
Filter · 2 arguments · 2 call sites
Filters the answers about to be stored with a submission.
Runs before the entry is written and before any integration is scheduled. Use it for values the
server computes; for extra keys from the request use xpac_forms_entries_extra_answer_keys.
Values are stored as text, arrays joined with commas. Only the stored copy changes: integrations
get the submitted answers. Returning an empty array stores no entry, except for submissions through
the public submit route, which are always stored. Also runs for spam entries, with the verdict
under Logger::META_SPAM; no integration runs for those.
apply_filters( 'xpac_forms_entries_entry_data', self::answersFor($submission), $submission->forExternalCallback() )
apply_filters( 'xpac_forms_entries_entry_data', $answers, $submission->forExternalCallback() )$data(array<string, mixed>) — Answers, keyed by field name.$submission(Submission) — Submission being stored.
Returns array<string, — mixed> Answers to store, keyed by meta key.
Fired from:
packages/Forms/core/entries/Logger.php:89packages/Forms/core/entries/Logger.php:184
xpac_forms_entries_entry_lifetime
Filter · 2 arguments · 1 call site
Filters how many days an untouched submission is kept for.
A submission untouched for longer goes to the Trash, or is deleted when the trash lifetime is 0. Zero or less switches retention off for that form: nothing is trashed or deleted.
apply_filters( 'xpac_forms_entries_entry_lifetime', self::retentionDays(), $form_id )$days(int) — Days to keep. Default 0, or the site's setting.$form_id(int) — The form post ID.
Returns int — Days to keep; 0 or less keeps every submission.
Fired from:
packages/Forms/core/entries/Cleaner.php:144
xpac_forms_entries_extra_answer_keys
Filter · 2 arguments · 1 call site
Filters the POST keys a submission may store that are not field blocks.
For add-ons that post their own keys, such as Stripe's stripe. Other unknown keys are dropped.
For values the server computes, use xpac_forms_entries_entry_data instead. Keys starting with
_xpf_ are reserved and still dropped.
apply_filters( 'xpac_forms_entries_extra_answer_keys', [], $submission->forExternalCallback() )$keys(string[]) — Extra POST keys to store. Default none.$submission(Submission) — Submission being stored.
Returns string[] — Extra POST keys to store.
Fired from:
packages/Forms/core/entries/Logger.php:415
xpac_forms_entries_field_value
Filter · 5 arguments · 1 call site
Filters one submitted answer before it is stored.
Runs once per answer, before the entry is written and before any integration is scheduled. Not called for checklist, dropdown, confirmation and password fields. Only the stored copy changes; integrations still receive what the visitor posted.
apply_filters( 'xpac_forms_entries_field_value', $meta_value, $type, $meta_key, $blocks, $submission->forExternalCallback() )$meta_value(mixed) — Submitted value.$type(string) — Field type, e.g. "text", "email", "file".$meta_key(string) — Field name, used as the meta key.$blocks(array<string, array>) — The form's field blocks by name, each with itstype.$submission(Submission) — Submission being stored.
Returns mixed — Value to store; arrays are joined with commas, anything else cast to string.
Fired from:
packages/Forms/core/entries/Logger.php:266
xpac_forms_entries_status_changed
Action · 3 arguments · 1 call site
Fires after submissions move to a new status, such as spam or trash.
Fires after the change is saved, from the Submissions screen and when retention trashes old submissions. Anti-spam add-ons use it to report a corrected verdict. Only entries whose status changed are passed.
do_action( 'xpac_forms_entries_status_changed', array_keys($moved), $status, $moved )$ids(int[]) — Entry ids that changed.$status(string) — The new status: "active", "spam" or "trash".$previous(array<int, string>) — Entry id => status before the change.
Fired from:
packages/Forms/core/entries/Admin/EntriesQuery.php:1212
xpac_forms_entries_table_additional_columns
Filter · 2 arguments · 1 call site
Filters the columns a form's submissions are listed under.
Receives field name => label for at most the form's first three fields. A key must be a meta key the
entry stores; for an add-on's own column, the key it wrote through xpac_forms_entries_entry_data.
Added columns also go into the CSV export after the form's fields, and a removed one is left out of it.
Asked once per form for the submissions screen, a single submission, the overview and both exports.
apply_filters( 'xpac_forms_entries_table_additional_columns', $columns, $form )$columns(array<string, string>) — Column key => label.$form(WP_Post) — The form post.
Returns array<string, — string> Columns shown by default, column key => label.
Fired from:
packages/Forms/core/entries/Admin/FormFields.php:270
xpac_forms_entries_table_additional_sortable_columns
Filter · 2 arguments · 1 call site
Filters which submission columns are declared sortable.
Kept for compatibility: the submissions screen lets every field sort and does not read the result.
apply_filters( 'xpac_forms_entries_table_additional_sortable_columns', $sortable, $form )$sortable(array<string, array>) — Column key => [key, direction].$form(WP_Post) — The form post.
Returns array<string, — array> Column key => [key, direction]; only the keys are kept.
Fired from:
packages/Forms/core/entries/Admin/FormFields.php:286
xpac_forms_entries_trash_lifetime
Filter · 1 argument · 1 call site
Filters how many days a trashed submission is kept before deletion.
Zero deletes submissions past the retention window outright. Read only for forms with retention on.
apply_filters( 'xpac_forms_entries_trash_lifetime', $days )$days(int) — Days a trashed submission is kept. Default EMPTY_TRASH_DAYS.
Returns int — Days a trashed submission is kept; 0 skips the Trash.
Fired from:
packages/Forms/core/entries/Cleaner.php:163
xpac_forms_entries_{$type}_field_value
Filter · Dynamic name · 3 arguments · 1 call site
Filters one stored answer as it is rendered for the admin.
{$type} is the field's block name without xp/form-field-: "text", "email", "textarea", "number",
"phone", "url", "date", "time", "dropdown", "radio", "checklist", "confirmation", "consent", "file",
"hidden" or "dynamic-select", plus any type an add-on registers (User Profiles adds "password").
A block outside that prefix uses what xpac_forms_{$name}_field_type returns, "text" by default.
It does not fire for a field since removed from the form. The CSV export uses it too, flattened
to text, and skips rendering for a type nothing listens on.
apply_filters( "xpac_forms_entries_{$type}_field_value", $value, $blocks[$key]['attrs'], $context )$value(string) — The escaped answer, or the rendered links for a file field.$attrs(array) — The field block's attributes, including its label.$context(string) — "archive" for the table and exports, "single" for one submission.
Returns string — Markup to show; it goes through wp_kses_post(), so a form, input or select is stripped.
Fired from:
packages/Forms/core/entries/Admin/FormFields.php:372
xpac_forms_entry_write_failed
Action · 3 arguments · 1 call site
Fires when a submission could not be stored.
Fires while the entry is written, before any integration is scheduled; no integration runs for a submission that was not stored.
do_action( 'xpac_forms_entry_write_failed', $reason, $form_id, $error )$reason(string) — 'entry' (the row), 'meta' (the answers), 'commit' (publishing the row) or 'cleanup' (removing a partial row also failed).$form_id(int) — Form the submission was made against.$error(string) — Database error, or '' when none was reported.
Fired from:
packages/Forms/core/entries/Database.php:809
xpac_forms_form_accessible
Filter · 3 arguments · 1 call site
Filters whether the current request may use a form.
True reopens an unpublished form; false closes a live one. The context tells the paths apart and is open-ended: add-ons pass their own, such as "autosubmit", which also requires a published form, so only false has an effect there. Preview also needs a valid nonce and edit rights, which this filter cannot grant. To close every path, do not check the context.
apply_filters( 'xpac_forms_form_accessible', $accessible, $form, $context )$accessible(bool) — Whether the form may be used. Default: published, or readable by this user.$form(WP_Post) — The form post.$context(string) — Path asking: "render", "submit", "structure", "preview", or an add-on's own name.
Returns bool — Whether the form may be used.
Fired from:
packages/Forms/core/base/PostType.php:1007
xpac_forms_form_block_attributes
Filter · 4 arguments · 1 call site
Filters the HTML attributes printed on a form's <form> tag.
Runs only for a form the request may see. A non-array return counts as
empty. Forms then sets action, method, enctype, novalidate and
data-id itself and prepends xp-block-form to class. Leave
data-validation-events an array; it is JSON-encoded afterwards. Pass '1',
not true: get_block_wrapper_attributes() drops true.
apply_filters( 'xpac_forms_form_block_attributes', [ 'data-validation-events' => $settings->get( 'validation.events', [] ), 'data-message-position' => $settings->get('messages.position', 'bottom'), ] + self::getAfterSubmitAttributes($post), $post, $block, $settings )$attributes(array) — Attribute name/value pairs; starts withdata-validation-events,data-message-positionand, when set,data-after-submit.$post(WP_Post) — The form being rendered.$block(WP_Block) — The form block instance on the page.$settings(FormSettings) — The form's stored settings.
Returns array — Attribute name/value pairs.
Fired from:
packages/Forms/core/base/Blocks.php:1215
xpac_forms_form_requires_login
Filter · 2 arguments · 1 call site
Filters whether a form may only be submitted by a signed-in visitor.
apply_filters( 'xpac_forms_form_requires_login', ! empty($login['status']), $form )$required(bool) — Whether signing in is required. Default false.$form(WP_Post) — The form being checked.
Returns bool — Whether signing in is required.
Fired from:
packages/Forms/core/base/PostType.php:1103
xpac_forms_form_schedule
Filter · 2 arguments · 1 call site
Filters the window during which a form takes submissions.
status false means no schedule. start and end are "Y-m-d\TH:i" in
the site's timezone; either may be empty, and one that is not a time is ignored.
apply_filters( 'xpac_forms_form_schedule', [ 'status' => ! empty($schedule['status']), 'start' => (string) ($schedule['start'] ?? ''), 'end' => (string) ($schedule['end'] ?? ''), ], $form )$window(array) —statusbool,startandendwall-clock strings.$form(WP_Post) — The form being checked.
Returns array — status bool, start and end wall-clock strings.
Fired from:
packages/Forms/core/base/PostType.php:1054
xpac_forms_form_submission_limit
Filter · 2 arguments · 1 call site
Filters how many submissions a form accepts in total.
0 means no limit and costs no query or lock. Only active entries count; spam and trashed ones give their place back. A positive limit also serializes the final check and the entry write, so two requests cannot both take the last place.
apply_filters( 'xpac_forms_form_submission_limit', empty($limit['status']) ? 0 : (int) ($limit['value'] ?? 0), $form )$maximum(int) — Submissions the form accepts, 0 for no limit.$form(WP_Post) — The form being checked.
Returns int — Submissions the form accepts, 0 for no limit.
Fired from:
packages/Forms/core/base/PostType.php:1133
xpac_forms_idempotency_lock_timeout
Filter · 2 arguments · 1 call site
Filters how long a duplicate form-instance request waits for its first request.
apply_filters( 'xpac_forms_idempotency_lock_timeout', 3, $formId )$seconds(int) — Default three seconds, clamped to 0–5 seconds.$formId(int) — Current form id.
Returns int — Seconds to wait.
Fired from:
packages/Forms/core/base/Rest.php:753
xpac_forms_idempotency_ttl
Filter · 2 arguments · 2 call sites
Filters how long an accepted form-instance digest prevents a duplicate.
apply_filters( 'xpac_forms_idempotency_ttl', DAY_IN_SECONDS, $formId )$seconds(int) — Default one day, clamped to one minute–seven days.$formId(int) — Current form id.
Returns int — Seconds a duplicate is blocked.
Fired from:
packages/Forms/core/base/MutationGuard.php:565packages/Forms/core/base/Rest.php:725
xpac_forms_init
Action · 0 arguments · 1 call site
Fires when Forms is ready to be extended.
Runs on init at priority 200, after add-ons have loaded. Register field types, delivery actions
and routes here. Some registrars, such as PostType::enablePostTypeFieldBlockSupport(), only
accept calls made during this action.
do_action( 'xpac_forms_init' )Fired from:
packages/Forms/Bootstrap.php:136
xpac_forms_initialize_submission
Action · 1 argument · 1 call site
Fires once a submission has been built and before it is processed.
The last point where setData() and setRules() still apply. The request data, blocks and rules are resolved; validation has not run. Conditional Logic uses it to strip the answers of fields the visitor never saw.
do_action( 'xpac_forms_initialize_submission', $this )$submission(Submission) — The submission being initialised.
Fired from:
packages/Forms/core/base/Submission.php:287
xpac_forms_inline_js_data
Filter · 1 argument · 1 call site
Filters the data the form front end reads as window.xpacForms.
Printed once per page before the form view script; add-ons put their
front-end values here, such as captcha site keys. The object is
deep-frozen, and the keys Forms owns (nonce, nonceIssuedAt,
healthCheckUrl, validationMessages, submissionMessages,
maskScript, phoneField) are merged in afterwards and cannot be
replaced here. A non-array return is cast to one.
apply_filters( 'xpac_forms_inline_js_data', [] )$data(array) — Front-end data keyed by name. Default empty array.
Returns array — Front-end data keyed by name.
Fired from:
packages/Forms/core/base/Blocks.php:361
xpac_forms_integration_applies
Filter · 3 arguments · 1 call site
Filter whether an integration is dispatched for this submission.
Fires only for an integration that declared a settings key, on a form whose settings
hold that key with an items list. Asked once per submission, as its entry is written.
Return true to dispatch an integration this would otherwise skip.
apply_filters( 'xpac_forms_integration_applies', [] !== $items, $slug, $submission )$applies(bool) — Whether the integration has actions configured.$slug(string) — Integration slug.$submission(Submission) — Submission being dispatched.
Returns bool — Whether to queue a delivery for this integration.
Fired from:
packages/Forms/core/deliveries/Applicability.php:165
xpac_forms_integration_label
Filter · 2 arguments · 1 call site
Filters the name an integration is shown under.
Shown in the Deliveries table and its filter, a submission's deliveries, the paused notice and the paused email. Display only: it never changes what is sent, but the Deliveries search and CSV export use it.
apply_filters( 'xpac_forms_integration_label', $name, $slug )$name(string) — Default label: the namespace segment before the class, e.g. "Airtable".$slug(string) — Integration slug,Class::methodas Dispatcher::slugFor() built it.
Returns string — Label to show.
Fired from:
packages/Forms/core/deliveries/Health.php:237
xpac_forms_integration_paused_email
Filter · 3 arguments · 1 call site
Filters whether the site admin is emailed when an integration is paused.
Asked once per pause, from the background job that paused it. Return false to send nothing; the Deliveries screen still shows the pause.
apply_filters( 'xpac_forms_integration_paused_email', true, $formId, $slug )$send(bool) — Whether to send the email. Default true.$formId(int) — Form the integration is paused on.$slug(string) — Integration slug.
Returns bool — Whether to email the site admin.
Fired from:
packages/Forms/core/deliveries/Health.php:116
xpac_forms_keep_delivery_payload
Filter · 3 arguments · 1 call site
Filters whether a settled submission keeps the data Retry sends.
Asked once every delivery is delivered or skipped, just before the copy is deleted, and not asked again. Return true while a check of your own is still queued; a kept copy is still removed after 30 days.
apply_filters( 'xpac_forms_keep_delivery_payload', false, $entryId, $records )$keep(bool) — Whether to keep the copy. Default false.$entryId(int) — Entry id.$records(array<string, array<string, mixed>>) — Delivery records, keyed by integration slug.
Returns bool — Whether to keep the copy Retry sends.
Fired from:
packages/Forms/core/deliveries/DeliveryState.php:782
xpac_forms_overview_cache_ttl
Filter · 2 arguments · 1 call site
Filters how long, in seconds, the overview response is cached.
Two of its queries scan every entry, so the response is cached; keep it short so new submissions show. Return 0 to skip the cache.
apply_filters( 'xpac_forms_overview_cache_ttl', MINUTE_IN_SECONDS, $days )$ttl(int) — Seconds to hold the response. Default 60.$days(int) — Window the response describes, 0 for all time.
Returns int — Seconds to hold the response; 0 or less skips the cache.
Fired from:
packages/Forms/core/entries/Admin/Rest.php:605
xpac_forms_phone_default_country
Filter · 2 arguments · 1 call site
Filters the country a smart phone field falls back to for national numbers.
Defaults to the site locale's country (en_GB gives GB, hy gives none).
The browser opens the field on it when the field's default, the visitor's time
zone and languages give no accepted country; the server reads a number typed
without a calling code in it when the field's default is unset or not accepted.
It is printed into the page, so it must not vary per visitor on cached pages.
apply_filters( 'xpac_forms_phone_default_country', $country, $locale )$country(string) — Upper-case two-letter country code, or an empty string.$locale(string) — Site locale.
Returns string — Upper-case two-letter country code; anything else counts as none.
Fired from:
packages/Forms/core/base/PhoneField.php:117
xpac_forms_phone_masks
Filter · 1 argument · 1 call site
Filters the phone masks a field can use.
Each entry is id, name, mask, pattern and an optional countryCode.
The built-ins ("", US, international, any case) cannot be changed. An entry is
dropped unless the id is 1-32 letters, digits, _ or -; the mask is 0
digit slots and 0-9 ()+-./; the pattern works in both PHP and JavaScript;
and countryCode is 1-3 digits. Use a prefixed id such as acme-uk, and
hook at or before init. Runs only when a mask that is not built in is looked
up or the whole list is needed, as in the editor.
apply_filters( 'xpac_forms_phone_masks', $builtIns )$masks(array) — List of mask entries. Default the built-in masks.
Returns array — List of mask entries.
Fired from:
packages/Forms/core/base/PhoneMasks.php:199
xpac_forms_post_meta_default_values
Filter · 1 argument · 1 call site
Filters the settings blob a form starts life with.
One entry per settings panel, keyed by panel name, so a form that was never saved still reads a complete settings object. Forms' own panel defaults ("actions", "messages", "redirect", "validation", "entries") are merged in afterwards and win on a collision.
apply_filters( 'xpac_forms_post_meta_default_values', [] )$defaults(array) — Panel defaults keyed by panel name. Default empty array.
Returns array — Panel defaults keyed by panel name.
Fired from:
packages/Forms/core/base/PostType.php:401
xpac_forms_post_meta_schema
Filter · 1 argument · 1 call site
Filters the REST schema of a form's settings blob.
One JSON Schema entry per settings panel, keyed by panel name.
Declare every key an add-on stores: nested objects default to
additionalProperties false, and one undeclared key makes the
whole form_settings value null in the editor.
apply_filters( 'xpac_forms_post_meta_schema', [] )$properties(array) — Panel schemas keyed by panel name. Default empty array.
Returns array — Panel schemas keyed by panel name.
Fired from:
packages/Forms/core/base/PostType.php:207
xpac_forms_post_render_form
Action · 3 arguments · 1 call site
Fires after a form's markup has been assembled.
The markup can no longer change. For work that needs a form on the page, such as enqueuing a captcha script. Output is not captured.
do_action( 'xpac_forms_post_render_form', $post, $block, $settings )$post(WP_Post) — The form that was rendered.$block(WP_Block) — The form block instance on the page.$settings(FormSettings) — The form's stored settings.
Fired from:
packages/Forms/core/base/Blocks.php:1335
xpac_forms_post_script_dependencies
Filter · 1 argument · 1 call site
Filters the script handles the form editor script depends on.
An add-on's editor bundle added here loads first, in time to register its sidebar panels.
apply_filters( 'xpac_forms_post_script_dependencies', [] )$handles(string[]) — Registered script handles to add as dependencies. Default empty array.
Returns string[] — Registered script handles to add as dependencies.
Fired from:
packages/Forms/core/base/PostType.php:603
xpac_forms_post_style_dependencies
Filter · 1 argument · 1 call site
Filters the stylesheet handles the form editor styles depend on.
Add an add-on's editor CSS here to print it on the form edit screen.
apply_filters( 'xpac_forms_post_style_dependencies', [] )$handles(string[]) — Registered style handles to add as dependencies. Default empty array.
Returns string[] — Registered style handles to add as dependencies.
Fired from:
packages/Forms/core/base/PostType.php:560
xpac_forms_pre_render_form
Action · 3 arguments · 1 call site
Fires before a form's fields are rendered.
For setting up state the field blocks read. Output is not captured; print inside the form with xpac_forms_after_form_begin.
do_action( 'xpac_forms_pre_render_form', $post, $block, $settings )$post(WP_Post) — The form being rendered.$block(WP_Block) — The form block instance on the page.$settings(FormSettings) — The form's stored settings.
Fired from:
packages/Forms/core/base/Blocks.php:1269
xpac_forms_private_upload_directory
Filter · 2 arguments · 1 call site
Filters the absolute directory used for private form uploads.
May point outside the document root: downloads read the attachment's
stored path, not a URL. Forms creates it with deny-all .htaccess and
index.php files; when that fails, private uploads are refused.
apply_filters( 'xpac_forms_private_upload_directory', trailingslashit($uploads['basedir']) . self::DIRNAME, $uploads )$path(string) — Default absolute directory.$uploads(array) — Result of wp_upload_dir().
Returns string — Absolute directory.
Fired from:
packages/Forms/core/base/Uploads.php:115
xpac_forms_provider_blocks_data
Filter · 1 argument · 1 call site
Filters the values the server supplies for provider fields.
Keyed by provider field name, such as ---user-geo-country---. A value may
be a callable, resolved on first read. Every key becomes reserved: a
submitted value under the same name is dropped.
apply_filters( 'xpac_forms_provider_blocks_data', [] )$data(array) — Provider values, or callables returning them, keyed by field name. Default empty array.
Returns array — Provider values, or callables returning them, keyed by field name.
Fired from:
packages/Forms/core/base/Submission.php:232
xpac_forms_quarantine_spam
Filter · 3 arguments · 1 call site
Filters whether a refused submission is stored for review.
The entry is stored with status spam and no integration runs for it. Return false to discard refused submissions instead.
apply_filters( 'xpac_forms_quarantine_spam', true, $submission->forExternalCallback(), $verdict )$store(bool) — Whether to write a quarantined entry.$submission(Submission) — Submission that was refused.$verdict(array) — Detector slug and reason.
Returns bool — Whether to store the refused submission as a spam entry.
Fired from:
packages/Forms/core/entries/Logger.php:168
xpac_forms_redirect_config
Filter · 1 argument · 1 call site
Filters where a form sends the visitor after a submission.
enable is false and the URLs empty unless one of the form's redirect items
matched. No submission is passed, so to target one form, add the callback
while that form is being processed. Other keys are dropped, a non-bool
enable counts as false, and both URLs go through esc_url_raw().
apply_filters( 'xpac_forms_redirect_config', $base )$config(array) — Redirect settings:enablebool,successanderrorURLs.
Returns array — Redirect settings: enable bool, success and error URLs.
Fired from:
packages/Forms/core/base/Submission.php:584
xpac_forms_render_form_content
Filter · 4 arguments · 1 call site
Filters whether a form's own fields are printed.
False keeps the <form> and what xpac_forms_after_form_begin and
xpac_forms_before_form_end print, and runs none of the fields' queries.
apply_filters( 'xpac_forms_render_form_content', true, $post, $block, $settings )$render(bool) — Whether to print the form's fields. Default true.$post(WP_Post) — The form being rendered.$block(WP_Block) — The form block instance on the page.$settings(FormSettings) — The form's stored settings.
Returns bool — Whether to print the form's fields.
Fired from:
packages/Forms/core/base/Blocks.php:1300
xpac_forms_request_volatile_keys
Filter · 1 argument · 1 call site
Filters the top-level body keys left out of a submission's replay hash.
For values the browser regenerates on every attempt, such as spam-check tokens. Never name an answer field: it would stop telling one submission from another.
apply_filters( 'xpac_forms_request_volatile_keys', [ 'cloudflareCAPTCHA', 'cf-turnstile-response', 'reCAPTCHA', 'g-recaptcha-response', ] )$keys(string[]) — Body keys to leave out. Default the Turnstile and reCAPTCHA token keys.
Returns string[] — Body keys to leave out.
Fired from:
packages/Forms/core/base/Rest.php:561
xpac_forms_spam_submission
Action · 2 arguments · 1 call site
Fires when a spam detector has refused a submission.
xpac_forms_after_submit does not run for it, and no files have been
stored yet. Logger stores the attempt as spam here, so it can be
restored from the Spam tab.
do_action( 'xpac_forms_spam_submission', $this->forExternalCallback(), $this->spam_verdict )$submission(Submission) — Submission that was refused.$verdict(array) —detectorslug andreason, as passed to flagAsSpam(): "spam" for a verdict, anything else for a failure to reach one.
Fired from:
packages/Forms/core/base/Submission.php:1387
xpac_forms_structure_response
Filter · 1 argument · 1 call site
Filters the field schema the public structure route hands out.
Fields hidden through metadata.blockVisibility, and fields whose block registered no
structure provider, are already left out. The route is unauthenticated: anything added here
is readable by anyone who can reach a published form.
apply_filters( 'xpac_forms_structure_response', $structure->build() )$structure(array) — One entry per rendered field, in document order:['blockName' => string, 'fieldType' => string|null, 'metadata' => array], metadata being the field's attributes withoutlockandmetadata.
Returns array — Field entries to hand out, same shape.
Fired from:
packages/Forms/core/base/Rest.php:905
xpac_forms_submission_info
Action · 1 argument · 1 call site
Fires while one submission's info panel is built.
Fires each time one submission is opened, long after it was stored, and only when a listener is
attached. Whatever a listener echoes is returned unfiltered as info_html and shown in the panel,
so it can include form controls.
do_action( 'xpac_forms_submission_info', $legacy )$entry(array) — The entry row's columns (id,form_id,created,updated,status,source_url,user_agent,delivery_failures,is_read,is_starred), plusmetadata: a list of['meta_key' => …, 'meta_value' => …]without reserved keys.
Fired from:
packages/Forms/core/entries/Admin/Rest.php:2013
xpac_forms_submission_invisible_blocks
Filter · 3 arguments · 1 call site
Filters the field names this submission should treat as not shown to the visitor.
Fires while the submission is built, before validation, once per pass until two passes return the same names, so callbacks must be idempotent. During the call getData() and getRules() leave out the names in $hidden; getAvailableFieldNames() does not. Names from the last pass are dropped from the stored answers and the validation rules, and count as unanswered in action conditions.
apply_filters( 'xpac_forms_submission_invisible_blocks', $invisible_blocks, $submission, $hidden )$invisible_blocks(array) — Field names the form's conditional wrappers hide.$submission(Submission) — The submission being initialised.$hidden(string[]) — Field names the previous pass found hidden.
Returns string[] — Field names to treat as not shown; names the form does not have are dropped.
Fired from:
packages/Forms/core/base/ConditionalLogic.php:660
xpac_forms_submission_lock_timeout
Filter · 2 arguments · 1 call site
Filters how long a constrained submission waits for the same form.
Only asked for a form with a submission limit or a Unique rule, which takes a per-form lock. Clamped to 0..30 seconds. A timeout is refused with a retryable 503 error.
apply_filters( 'xpac_forms_submission_lock_timeout', 5, $this )$seconds(int) — Seconds to wait. Default 5.$submission(Submission) — Submission waiting for its form.
Returns int — Seconds to wait.
Fired from:
packages/Forms/core/base/Submission.php:2118
xpac_forms_submission_messages
Filter · 1 argument · 1 call site
Filters the fallback messages a submission answers with.
Used when a form has no message of its own. Add a key for a new message.
Runs once per request, at the first lookup, so a callback added later is
never asked. The page also gets them as window.xpacForms.submissionMessages.
apply_filters( 'xpac_forms_submission_messages', [ 'validation_error' => __( 'Please correct the highlighted fields.', '{XPAC}' ), 'success_fallback' => __( 'Successfully submitted.', '{XPAC}' ), 'error_fallback' => __( 'Something went wrong.', '{XPAC}' ), 'missing_token' => __( "The spam check wasn't completed. Please complete it or reload the page, then submit again.", '{XPAC}' ), 'verification_failed' => __( 'The spam check failed. Please try again.', '{XPAC}' ), 'verification_error' => __( "The spam check couldn't be completed, so your answers were not sent. Please try again.", '{XPAC}' ), 'network_error' => __( 'Your answers were not sent because the site could not be reached. ' . 'Check your connection and try again.', '{XPAC}' ), 'server_error' => __( 'Your answers were not sent because the site ran into a problem. ' . 'Please try again in a few minutes.', '{XPAC}' ), 'timeout_error' => __( 'Your answers were not sent because the request took too long. Please try again.', '{XPAC}' ), 'options_unavailable' => __( 'The choices for this field could not be loaded. Reload the page to try again.', '{XPAC}' ), 'form_closed' => __( 'This form is closed and is not taking answers at the moment.', '{XPAC}' ), 'form_limit_reached' => __( 'This form has had all the answers it can take.', '{XPAC}' ), 'login_required' => __( 'Please log in to fill in this form.', '{XPAC}' ), ] )$messages(array) — Message strings keyed by outcome:validation_error,success_fallback,error_fallback,missing_token,verification_failed,verification_error,network_error,server_error,timeout_error,options_unavailable,form_closed,form_limit_reached,login_required. Addakismet_errorto reword Akismet's no-verdict message.
Returns array — Message strings keyed by outcome.
Fired from:
packages/Forms/core/base/Submission.php:2305
xpac_forms_submission_validation
Filter · 2 arguments · 1 call site
Filters the outcome of validating a submission.
Runs after the field rules, before uploads and the entry, so errors already
holds their refusals. Spam checks refuse here by setting success to false, and
call flagAsSpam() to keep the attempt as spam. Only success decides: true lets the
submission go on even with errors left in.
apply_filters( 'xpac_forms_submission_validation', $validation, $this )$validation(array) —successbool anderrors, a list offield/messagepairs.$submission(Submission) — The submission being validated.
Returns array — success bool and errors, a list of field/message pairs.
Fired from:
packages/Forms/core/base/Submission.php:2210
xpac_forms_submit_callbacks
Filter · 1 argument · 1 call site
Filters the integration callbacks a submission is delivered to.
Asked once per submission, as its entry is written; the named callbacks that apply are stored
with the entry. A [ClassName::class, 'method'] callback runs in its own background job and is
retried on failure, and is skipped when xpac_forms_integration_applies says so. Any other
callable runs once, inline, and is never retried.
apply_filters( 'xpac_forms_submit_callbacks', [] )$callbacks(array) — Callables, each taking one Submission.
Returns array — Callables, each taking one Submission.
Fired from:
packages/Forms/core/deliveries/Dispatcher.php:369
xpac_forms_submit_response
Filter · 2 arguments · 1 call site
Filters the body the submit route answers with.
Runs after the submission is processed (entry stored, integrations dispatched), so it only changes
what the visitor is shown. A filter can turn success into failure, never failure into success.
A key returned with the wrong type falls back to its original value, and redirect URLs are
sanitised afterwards. Rest::sendErrorResponse() hooks in at priority PHP_INT_MAX - 10.
apply_filters( 'xpac_forms_submit_response', $response, $submission->forExternalCallback() )$response(array) — Keys:success,validation(success,errors),message,messagePosition(top or bottom),redirect(enableflag,successanderrorURLs),datapassed to the browser as is, anderror(code,message,data) on a failure other than validation.$submission(Submission) — The submission, without write-only answers.
Returns array — Response body, same keys.
Fired from:
packages/Forms/core/base/Rest.php:421
xpac_forms_throttle_limit
Filter · 3 arguments · 1 call site
Filters how many submissions one IP may make to one form per window.
Default 20. Every attempt counts, valid or not, since counting runs before validation. An IPv6 address counts as its /64. Return 0 to disable the limit for that form.
apply_filters( 'xpac_forms_throttle_limit', self::LIMIT, $formId, $submission )$limit(int) — Attempts allowed inside the window.$formId(int) — Form being submitted.$submission(Submission) — Submission being attempted.
Returns int — Attempts allowed; 0 disables the limit.
Fired from:
packages/Forms/core/base/Throttle.php:78
xpac_forms_throttle_lock_timeout
Filter · 2 arguments · 1 call site
Filters how long the throttle waits to update one sender's counter.
Only used when the counter lives in the database, not a persistent object cache. Clamped to 0..5 seconds. A timeout is refused like a spent budget.
apply_filters( 'xpac_forms_throttle_lock_timeout', 1, $submission )$seconds(int) — Seconds to wait. Default 1.$submission(Submission) — Submission being counted.
Returns int — Seconds to wait.
Fired from:
packages/Forms/core/base/Throttle.php:249
xpac_forms_throttle_window
Filter · 3 arguments · 1 call site
Filters the throttle window, in seconds.
Default 300. The window starts at the sender's first attempt and is fixed, not sliding. Return 0 to disable the limit for that form.
apply_filters( 'xpac_forms_throttle_window', self::WINDOW, $formId, $submission )$window(int) — Window length in seconds.$formId(int) — Form being submitted.$submission(Submission) — Submission being attempted.
Returns int — Window length in seconds; 0 disables the limit.
Fired from:
packages/Forms/core/base/Throttle.php:92
xpac_forms_throttled
Action · 3 arguments · 1 call site
Fires when a submission is refused for exceeding the attempt limit.
Also fires when the counter cannot be updated (lock timeout or object cache failure); $attempts
is then the limit.
do_action( 'xpac_forms_throttled', $formId, $attempts, $submission )$formId(int) — Form being submitted.$attempts(int) — Attempts already recorded in the window.$submission(Submission) — Submission that was refused.
Fired from:
packages/Forms/core/base/Throttle.php:297
xpac_forms_upload_daily_quota
Filter · 2 arguments · 1 call site
Filters how many bytes of files one form may store in a day.
Stored files count against their form until the UTC day turns over; a refused submission hands its bytes back. A file that would go over the budget is refused, and the submission with it. Return 0 for no limit.
apply_filters( 'xpac_forms_upload_daily_quota', is_user_logged_in() ? 0 : GB_IN_BYTES, $formId )$bytes(int) — Daily budget in bytes. Default 1 GB for a visitor who is not logged in, 0 (no limit) for one who is.$formId(int) — Form the files are posted to.
Returns int — Daily budget in bytes, 0 for no limit.
Fired from:
packages/Forms/core/base/Uploader.php:415
xpac_forms_upload_errors
Filter · 2 arguments · 1 call site
Filters the files the server refused, before they stop a submission.
Runs once per submission, after every field's files are stored. Any error left removes every file this submission stored and refuses it as a validation error. Return an empty array to let the submission succeed without the refused files.
apply_filters( 'xpac_forms_upload_errors', $this->errors, $submission )$errors(array) — Field name => list of ['message' => string].$submission(Submission) — Submission the files were posted with.
Returns array — Field name => list of ['message' => string]. Empty to accept.
Fired from:
packages/Forms/core/base/Uploader.php:994
xpac_forms_upload_handler
Filter · 1 argument · 1 call site
Filters the class that handles this submission's file uploads.
Only asked when the request carries a form instance id. A class that does not extend AbstractUploader turns uploads off for the submission.
apply_filters( 'xpac_forms_upload_handler', Uploader::class )$handler(string) — Fully qualified uploader class name. Default Uploader::class.
Returns string — Fully qualified name of an AbstractUploader subclass.
Fired from:
packages/Forms/core/base/Submission.php:211
xpac_forms_uploader_blocks
Filter · 1 argument · 1 call site
Filters the fields an upload may be posted for.
Field name => parsed block, for the form's fields still in the
submission; a field hidden by conditional logic is not here. A file
part whose name is not a key is skipped, and so is one whose block's
field type is not file. Only runs when files were posted.
apply_filters( 'xpac_forms_uploader_blocks', array_intersect_key( $submission->getBlocks(), array_flip($submission->getAvailableFieldNames()) ) )$blocks(array) — Field name => parsed block. ItsmaxUploadSize,selectedTypes,multipleandmaxFilesCountattributes set the limits.
Returns array — Field name => parsed block. Remove a key to refuse uploads for that field.
Fired from:
packages/Forms/core/base/Uploader.php:899
xpac_forms_uploads_private
Filter · 1 argument · 1 call site
Filters whether form uploads are stored privately.
apply_filters( 'xpac_forms_uploads_private', ! empty($stored) && 'no' !== $stored )$private(bool) — Whether new uploads are kept out of the web root. Default: the site's setting.
Returns bool — Whether new uploads are kept out of the web root.
Fired from:
packages/Forms/core/base/Uploads.php:68
xpac_forms_use_assets_in_post_type_with_field_support
Filter · 2 arguments · 2 call sites
Filters whether the form editor assets load on this screen.
Asked twice per screen, for the stylesheet and the script, and only for post types that support field blocks: true cannot add a post type enablePostTypeFieldBlockSupport() has not registered. False prints nothing.
apply_filters( 'xpac_forms_use_assets_in_post_type_with_field_support', true, $typenow )$use(bool) — Whether to load the editor assets. Default true.$typenow(string) — Post type of the screen being printed.
Returns bool — Whether to load the editor assets.
Fired from:
packages/Forms/core/base/PostType.php:543packages/Forms/core/base/PostType.php:585
xpac_forms_validation_block_rules
Filter · 1 argument · 1 call site
Filters the validation rules a form block is checked against.
Keyed by full block name (e.g. xp/form-field-email), each with a list of
rule class names or ['rule' => class, 'options' => array] entries. Each
rule must extend Rules\Rule; anything else is dropped. The rules run
after the block's own, in order until one refuses, and none can be removed
here. Runs on every read of a block's rules or the message catalogue, so
cache costly work.
apply_filters( 'xpac_forms_validation_block_rules', [] )$rules(array<string, array>) — Rule lists keyed by block name. Default empty array.
Returns array<string, — array> Rule lists keyed by block name.
Fired from:
packages/Forms/core/validation/Validators.php:145
xpac_forms_validation_choices_allowed_values
Filter · 2 arguments · 1 call site
Filters the values a choice field accepts.
Runs for dropdown, radio, checklist and Dynamic Select fields on each validated submission. A submitted value not in the list refuses the submission before the entry is stored. Values are compared as strings, and a blank answer is never checked. Return an empty array to switch the check off for the field.
apply_filters( 'xpac_forms_validation_choices_allowed_values', $values, $block )$values(array) — Values the field offers, as strings.$block(array) — The parsed block being validated.
Returns array — Allowed values; non-scalar members are dropped, the rest cast to strings.
Fired from:
packages/Forms/core/validation/rules/Choices.php:162
xpac_forms_validation_{$name}_rule_message
Filter · Dynamic name · 2 arguments · 1 call site
Filters the message a validation rule reports when it refuses a value.
The variable part is the rule's getName(): "required", "email", "url", "format",
"equality", "exclusion", "choices", "range", "length", "pattern", "unique", "phoneNumber",
"phoneNumberCountry", "fileMaxCount", "fileMaxSize", "fileMimeType", or an add-on's own,
such as User Profiles' "passwordStrength". During validation it fires only for the first
rule that fails on a field, before the entry is stored. The field's own message option
is applied before it and the result is sanitised after it. Keep any %s, %1$s or %2$s
placeholder: the value is filled in afterwards.
apply_filters( "xpac_forms_validation_{$name}_rule_message", $message, $rule )$message(string|array) — Message the rule will report. While the browser's catalogue is built, "range" and "length" passboth,minandmaxwordings.$rule(Rule|null) — Rule instance, or null when asked without a field, as for the catalogue.
Returns string|array — Message the rule reports, in the same shape.
Fired from:
packages/Forms/core/validation/rules/Rule.php:148
xpac_forms_{$action}_callbacks
Filter · Dynamic name · 2 arguments · 1 call site
Filters the callbacks run before a submission is accepted.
The only name fired is xpac_forms_pre_submit_callbacks, after validation and
uploads and before the entry is stored. A plain callable is a gate and gets a
credential-free copy. A mutation descriptor (callback, phase => 'mutation',
id) gets the original once every gate accepts; two descriptors refuse the
submission. Returning a WP_Error, false or a non-empty string refuses it and rolls
back its uploads. Registering must have no side effects.
apply_filters( "xpac_forms_{$action}_callbacks", [], $safeSubmission )$callbacks(array) — Gates and mutation descriptors. Default empty array.$submission(Submission) — Credential-free copy, for deciding what to register.
Returns array — Gates and mutation descriptors; anything else is dropped.
Fired from:
packages/Forms/core/base/Submission.php:1558
xpac_forms_{$name}_field_type
Filter · Dynamic name · 1 argument · 1 call site
Filters the field type a block contributes to a form.
Only for blocks outside the xp/form-field- prefix; a block inside it has the
type that follows the prefix, such as text, email or file. The variable part
is the full block name, as in xpac_forms_acme/rating_field_type. Entries, emails
and integrations treat the value by its type; file lets the field take uploads.
apply_filters( "xpac_forms_{$name}_field_type", 'text' )$type(string) — Field type slug. Default 'text'.
Returns string — Field type slug.
Fired from:
packages/Forms/core/base/Blocks.php:155