Appearance
Settings reference
The Settings tab has a side menu: one long Settings page with section anchors, then Notifications, Integrations, Embed, and Preview on pages of their own. Which sections appear depends on the kind of form.
- Registration-only settings
- Login and reset-only settings
- Product options settings
- Notifications · Integrations
Who can use it
| Setting | Options | Applies to |
|---|---|---|
| Access | Logged-in users · Only these roles · Anyone, even logged out | Post, standalone |
| Roles | Which roles, when access is by role | Post, standalone |
| Posts from logged-out visitors belong to | A user account that owns what anonymous visitors submit | Post |
A visitor who cannot submit sees a message with a login link. Word that message under Confirmations.
Registration, login, reset, and product options forms are open to anyone by definition, so they have no access setting.
What it does — create, edit, or both
| Setting | Options | Applies to |
|---|---|---|
| What it does | Creates a new post · Edits an existing post · Both | Post |
| Which post it edits | The post the page is showing · The post named in the address | Post |
| Address parameter | The query parameter naming the post. Default edit | Post |
| Submit button | The button's label | All |
| Submit button when editing | The label in edit mode | Post |
An edit-capable form opens prefilled and saves back to the same post, keeping its status.
/submit-listing/?edit=123Forms saved before the parameter was configurable
Older forms used ?post=123. Those are migrated to edit automatically. If you have links in the wild using ?post=, set the Address parameter back to post.
Who can edit a post
| Setting | Options |
|---|---|
| Editing is open to | The post's author only · Any logged-in user · Only these roles · Whoever WordPress lets edit it |
| Roles | Which roles, when editing is by role |
Administrators and editors can always edit. Everyone else sees "You cannot edit that post."
Roles named here can edit any post the form reaches, not only their own — that is the point of the option, and the reason to reach for it carefully.
New posts
| Setting | Options |
|---|---|
| Status | Pending · Published · Draft · Private |
| Author | The submitting user · A fixed user |
| That user | Which user, when the author is fixed |
Pending is the default: a submission waits for review and shows on the dashboard until someone decides it. Editing an existing post always keeps its status.
Terms
| Setting | What it does |
|---|---|
| New terms | Add terms that do not exist yet when a visitor types a new one |
Off by default. Turn it on for tags; leave it off for a controlled taxonomy.
Confirmations
What happens after a submission. The exact options depend on the kind of form.
| Setting | Options |
|---|---|
| Then (post, standalone) | Show a message · Go to the new post · Go to a page |
| Then (registration) | Show a message · Go to a page |
| Then (login) | Reload the page · Show a message · Go to a page |
| Then (reset) | Show a message · Go to a login form · Go to a page |
| Message | The message shown, when the choice is a message |
| After changes are saved | The same three choices, for an edit |
| Message after an edit | The message shown after an edit |
| When the form can't be used | What a visitor sees when access says no |
Messages accept smart codes, so Thanks, {user_name} works. Redirect addresses accept them too, and are escaped as a URL once they are filled in.
Bots
| Setting | What it does |
|---|---|
| Bot check | A hidden trap field bots fill in, plus a timing check. Nothing for a real visitor to do |
| Fastest allowed submission | Seconds from page load. Anything quicker is refused and asked to try again. Default 3 |
| Cloudflare Turnstile | Adds a Turnstile check to this form |
Turnstile keys are set once for the whole site under VX Modules → Settings → Bot protection, not per form. That screen also spots keys another plugin already has and offers to adopt them, so you do not have to find them again.
Each form then has its own Turnstile switch. The switch cannot be turned on until keys exist.
The trap and the timer are free
The honeypot and the timing check cost nothing and stop most of what hits a small site. Turn Turnstile on when a specific form is actually being abused.
Visitor details
| Setting | What it does |
|---|---|
| Keep details about each visit | Browser, system, device, screen size, language, time zone, the page the form was on, where the visitor came from, and how long the form took. Shown on the entry |
| Keep the IP address | Off by default |
| Anonymize it | Drops the last part of the address — 192.168.1.0 instead of 192.168.1.42 |
IP addresses are personal data
Under EU rules an IP address is personal data. Keep it only if you have a reason to, say so in your privacy policy, and leave Anonymize it on unless the reason needs the full address.
Login and password reset forms never collect visitor details, whatever these settings say.
Uploads
The largest upload a form accepts is set per file field — see Fields and their settings. The site's own upload limit is the ceiling; a field set higher still cannot exceed it.
Embed
| Item | What it is |
|---|---|
| Shortcode | [vx_form id="your-form-id"], with a copy button |
| Block, Elementor, Bricks | Add VX Form in the block editor, the Elementor widget list, or the Bricks elements, and pick this form |
Preview
The form on a bare page in a frame, exactly as a visitor would meet it. It is a real render, not a mock-up, so conditional fields behave and styles apply.