DEV Community

Pavel Silinskii
Pavel Silinskii

Posted on

I built a free WordPress contact form plugin with REST API — here's what I learned

#wordpress #php #webdev #plugin

I just published my first WordPress plugin to the official directory.
Here's what I built and what I learned along the way.

What the plugin does

Pavel Silinskii Contact Forms is a contact form builder with:

  • Drag-and-drop form editor
  • 7 field types (text, email, phone, textarea, select, checkbox, radio)
  • All submissions stored in the WordPress database
  • Email notifications on every submission
  • REST API with 4 endpoints
  • CSV export of submissions
  • Honeypot spam protection

What I learned from the review process

WordPress.org has a volunteer review team that checks every plugin
before approval. They caught two issues in my submission:

  1. My namespace was ACF\ which conflicted with Advanced Custom Fields
    (6M+ installs). Always use unique prefixes.

  2. Plugin name was too generic — "Contact Forms" alone isn't distinctive
    enough. Author name must be at the beginning.

Both issues were fixed and the plugin was approved.

Try it

Plugin: https://wordpress.org/plugins/pavel-silinskii-contact-forms/
GitHub: https://github.com/pavelsilinskiiwork/advanced-contact-forms

Would love feedback from the community.

Top comments (2)

Collapse
 
rahul_sharma_15bd129bc69e profile image
Rahul Sharma •

Great insights on building API endpoints for forms! Handling nested JSON payloads and converting file uploads to Base64 without crashing server timeouts is always a tough nut to crack on WordPress. That’s actually a key reason tools like Contact Form to Any API exist to abstract that payload mapping and token authentication layer so developers don't have to keep re-inventing the backend logic.

Collapse
 
webdecoy profile image
webdecoy •

Feedback from the WebDecoy team: I’d test the REST submit endpoint directly as well as the rendered form. The honeypot and rate limits need to run before the database write and notification email, otherwise a request can trigger side effects before it is classified.

For the other endpoints, separate public submission access from permission to list/export entries or edit form settings, and test each as an anonymous visitor. We build bot detection for WordPress, and that form-to-endpoint boundary is a useful compatibility test. Do you have endpoint-level tests for those cases yet?