Forms Auto Submit
Submit preset answers when someone opens a signed link.
Forms Auto Submit submits preset answers to a form when someone opens a signed link. Use it for simple actions such as an RSVP.
You need a server-side integration to create links. The form editor does not generate
them, and a mail-merge link such as ?email=[EMAIL] will not work. Fill in all answers
before signing each recipient's link.
Set it up
Edit the form, open Auto Submit in the document sidebar and turn Enable on. Update the form. Copied forms start with Auto Submit disabled.
Call Addon::buildSignedUrl() from your server-side integration with the form ID
and the recipient's exact answers.
use XPACGroup\Plugin\FormsAutoSubmit\Addon;
$url = Addon::buildSignedUrl(
128,
[
'email' => '[email protected]',
'rsvp' => 'yes',
],
30 * MINUTE_IN_SECONDS
);
if (is_wp_error($url)) {
// Handle the error instead of sending a link.
return;
}
// Send $url to the recipient.Use each field's name as the array key. Values can be scalars or flat lists for fields with multiple answers. Unknown fields, nested values and URLs over 8,192 bytes are rejected.
The optional third argument sets the lifetime in seconds. The default is one hour; the minimum is five minutes and the maximum is seven days.
What happens when the link opens
The form must be published and accessible, with Auto Submit enabled. Opening the link shows a “Send your answers” page. Its script posts the answers back to the same address as soon as it runs; a visitor whose script does not run, or who gets there first, can press its Send button instead. Only that POST submits: a valid, unexpired link then runs normal validation, saves an entry and queues its deliveries. Opening the same link again shows “already received” without creating another entry or duplicate delivery. Invalid answers show a short error summary. A configured safe redirect still applies.
Every link submits as a signed-out visitor, so its entry is anonymous even when the recipient is signed in. A form that requires a signed-in visitor, or that runs a sign-in action from User Profiles or a Community Platform report action, cannot get a link at all. A link built for such a form before this restriction existed now shows a page saying the link cannot complete the form.
Google reCAPTCHA and Cloudflare Turnstile cannot run from a link. Akismet, the honeypot and submission limits still apply.
Opening the link is not submitting the form
A scanner or link preview that only fetches the page runs nothing. One that renders the page and lets its script run does send it, the same as the recipient's own browser. Do not use Auto Submit for payments, limited reservations or actions that need proof of the person's identity or intent.
Limits
- File Upload, Consent, Password and Confirmation answers are not supported, including text fields mapped to a User Profiles account password. A required field of these types makes the form unsuitable for Auto Submit.
- Answers are visible in the URL and may appear in browser history and logs. Keep passwords, secrets and sensitive answers out of links. Use opaque IDs where possible.
- Changing any signed answer invalidates the link. Generate a new link when answers change, and keep signing code on the server.
For developers
buildSignedUrl() returns a URL or WP_Error. Prefer it over the lower-level
Addon::signLink() method, which requires you to generate the request ID and encode
the URL correctly. Reissue old links that signed only the form ID and expiry.
Use xpac_forms_autosubmit_link_ttl to change the default lifetime within the same
bounds. See the hook reference for other extension points.