Zapier

Zapier extends Forms with a Zapier panel on every form. Each enabled action sends one JSON POST request to a Zapier Catch Hook after Forms has safely stored the entry.

Delivery is queued. A slow or unavailable Catch Hook does not hold the visitor's request open, and its result appears with the entry on the Deliveries screen.

Set up a Zap

Controls

Conditional Logic can add a condition to an individual Zapier action. A condition that does not match is an intentional skip, not a failed delivery.

Payload rules

All Fields

The outgoing key is each field block's name; the value is that field's submitted answer. Unnamed fields and answers removed because a conditional section was hidden are omitted.

Two safety rules apply:

• Password fields are never sent.
• File fields are omitted unless Forward public file URLs is enabled.

Select Fields

Every row has an explicit source type. This prevents a renamed or deleted form field from silently becoming a fixed string. A Form field row whose field no longer exists fails the delivery with an actionable configuration error. A Fixed value row sends exactly the stored string.

Keys must be non-blank and unique. Missing, duplicate, unresolved, or malformed rows fail before any request is made. A hidden or unanswered field that still exists is simply absent from that submission's payload.

Files

File forwarding is off by default in both modes. When enabled, each attachment is sent as a URL, not as file bytes.

Submission metadata

Enable Include submission metadata to add:

{
	"_xpac": {
		"form_id": 42,
		"entry_id": 731,
		"site_url": "https://example.com/"
	}
}

_xpac is reserved while this option is enabled. The entry ID is stable across delivery retries and can be used by a Zap to reject a duplicate.

Delivery and retries

Forms stores the entry and durable delivery record before scheduling the Zapier request. The worker sends actions sequentially, with a ten-second response timeout (filterable but clamped to 1–30 seconds), and accepts only HTTP 2xx responses. Transport failures, rate limits, and server errors are classified for retry; permanent configuration and client errors remain visible for an administrator to fix and retry.

If one action succeeds and a sibling fails, the successful action is recorded and is not sent again when the delivery job retries.

The visitor's successful form response does not depend on Zapier. Monitor failures in XPAC → Forms → Submissions → Deliveries and keep the Forms delivery worker/Action Scheduler healthy.

URL safety

The URL must:

• begin with http:// or https://;
• contain a readable host;
• contain no embedded username or password; and
• avoid loopback, private/reserved IP literals, and unsafe ports.

The actual request uses WordPress's safe HTTP client, so DNS-time redirects and resolved private addresses are checked as well. Standard tokenized Zapier Catch Hook URLs, including query strings, are accepted.

xpac_zapier_allow_unsafe_url exists for controlled private-network deployments, but returning true disables important SSRF protections for that request. Prefer a narrow host check and keep the default on internet-facing sites.

Stored settings

Settings live in the form's edit-context form_settings meta. A current selected mapping looks like this:

{
	"zapier": {
		"items": [
			{
				"status": true,
				"title": "CRM intake",
				"request": {
					"url": "https://hooks.zapier.com/hooks/catch/123456/abcdef/"
				},
				"body": {
					"type": "selected",
					"includeFiles": false,
					"includeMetadata": true,
					"fields": [
						{
							"key": "email",
							"kind": "field",
							"field": "email"
						},
						{
							"key": "source",
							"kind": "literal",
							"field": "website"
						}
					]
				}
			}
		]
	}
}

The meta schema declares status, request data, body mode, source kind, file and metadata choices. Invalid structures written outside the editor fail as configuration errors rather than raising a PHP type error or sending a partial payload.

Developer filters

xpac_zapier_field_value runs for every submitted form field, including opted-in files after their IDs become public URL arrays. Its original first four parameters remain unchanged; three identifying parameters were appended:

apply_filters(
	'xpac_zapier_field_value',
	$field_value,
	$field_type,
	$data,
	$blocks,
	$field_name,
	$payload_key,
	$submission
);

xpac_zapier_request_body receives the complete array before JSON encoding and may return an array or WP_Error:

apply_filters(
	'xpac_zapier_request_body',
	$payload,
	$item,
	$submission
);

The package also exposes xpac_zapier_request_timeout and the advanced URL-safety override described above. It registers no public REST route of its own.