WordPress integration

Use WordPress for the page and FormNode for the workflow form. The plugin gives site builders a FormNode admin area, saved embeds, preview, health checks, a block, and shortcodes, while submissions, dynamic fields, approvals, and webhook delivery stay in FormNode.

This is the right fit when a WordPress form needs to trigger a real process. For simple newsletter signups or basic contact forms, a native WordPress form plugin may still be the simpler choice.

Install the plugin

The WordPress plugin lives in the FormNode repository under integrations/wordpress/formnode. Copy that folder into a WordPress install, then activate FormNode from the Plugins screen.

cp -R integrations/wordpress/formnode /path/to/wp-content/plugins/formnode

Save a reusable embed

Open FormNode > Add Form, paste the share URL copied from FormNode, then set the display name, mode, height, and optional organization context. The plugin parses FormNode /f/... and /organizations/.../form/... URLs.

The plugin builds FormNode URLs from that base URL and the form/org IDs you provide. It does not accept arbitrary iframe URLs in shortcode attributes.

Preview and check health

Each saved embed shows a WordPress admin preview and generated shortcode. Open FormNode > Health to check whether WordPress can reach the configured FormNode domains and to review CSP guidance for strict client sites.

Use the block editor

Add the FormNode form block and choose a saved FormNode embed from the sidebar. You can still use manual form settings for one-off embeds, but saved embeds are easier to manage across client pages.

Use a shortcode

For the classic editor, page builders, or templates that support shortcodes, use the generated saved embed shortcode:

[formnode key="employee-onboarding"]

Direct shortcodes are supported for one-off embeds:

[formnode id="FORM_ID"]

Direct form-ID shortcodes and manual block settings require FormNode > Settings > Manual embeds to be enabled. Saved embed shortcodes work by default.

If the form should load against a customer or tenant slug, include org:

[formnode id="FORM_ID" org="customer-slug" height="900"]

If you are using the organization route copied from FormNode, include organization_id:

[formnode id="FORM_ID" organization_id="ORG_ID" transparent="true"]

Security model

The WordPress plugin is embed-focused. It does not store FormNode API keys, proxy submissions through WordPress, or receive webhook payloads. The form is rendered from FormNode, and submissions go directly to FormNode before webhook delivery runs from the FormNode side.

• The FormNode admin area uses manage_formnode_embeds, granted to WordPress Administrators by default.
• Manual/direct embeds are disabled by default so content editors use saved embeds.
• The base URL is sanitized and must be a plain HTTP or HTTPS origin/path without query strings.
• Form and organization identifiers are treated as path segments, not raw URLs.
• The iframe uses a sandbox and strict referrer policy.

In the typical agency model of one WordPress install per customer, saved embeds are scoped to that customer's WordPress database. A customer admin can see embeds configured on their own site, but not embeds from another customer's separate WordPress install.

When to use custom domains

For client-facing sites, use a FormNode custom domain such as forms.clientsite.com or forms.youragency.com. This keeps the visible form URL branded and makes Content Security Policy updates easier to reason about.

Troubleshooting

The form does not appear

Check the Form ID and base URL first. If the page has a strict Content Security Policy, add your FormNode domain to frame-src.

The form is cut off

Increase the height on the block or shortcode. Conditional sections and multi-page forms often need more room than a simple contact form.

The form needs a login

Authentication-gated forms should usually be shared through the customer portal instead of a public WordPress embed.