Automate WordPress Forms with Claude Code (No Plugins Required)

I've built hundreds of WordPress forms over the years. Most of them started with Contact Form 7 or Gravity Forms — standard tools that work fine until you need something custom. Then you're fighting the plugin's data structure, writing conditional logic in their UI, or paying for add-ons that still don't do exactly what the client needs.

With Claude Code I now build custom WordPress form handlers from scratch. No plugin overhead. Full control over validation, routing, and what happens after submission. A working contact form with spam filtering and email notifications takes about 2–3 hours to build, and it does exactly what the client wants with no compromise.

Here's how I do it and why this approach beats plugins for most business use cases.

Why Skip the Form Plugin

Form plugins made sense when building custom PHP was slow and error-prone. But in 2026, Claude Code can write a complete form handler faster than you can configure Gravity Forms' conditional logic UI. And the code you get is cleaner, faster, and easier to extend.

The three reasons I stopped using form plugins for client work:

• Database bloat — plugins like Gravity Forms store every submission in custom database tables. For high-traffic sites, that's thousands of rows you'll never look at. A custom handler can skip the database entirely and send data straight to your CRM or email tool.
• Performance overhead — most form plugins load JavaScript libraries on every page, even pages without forms. A custom handler loads only what it needs, exactly where it needs it.
• Inflexibility — when a client says "I need the form to do X after submission," a plugin either supports it natively, has a paid add-on, or requires custom code anyway. At that point you're writing code to work around the plugin instead of just writing the feature.

Claude Code removes the friction. You describe the form behavior in plain English, and it generates the PHP, validates inputs, handles errors, and connects to external APIs. The result is a lean, purpose-built system that does exactly one thing well.

How I Build Custom WordPress Forms with Claude Code

The process is the same for every form project, whether it's a simple contact form or a multi-step lead capture funnel. I'll walk through a real example: a consultation request form for a Vancouver-based law firm that needed to send leads directly into their CRM and trigger a follow-up email sequence.

Step 1: Define the Fields and Validation Rules

I start by listing exactly what the form needs to collect and how each field should be validated. For this law firm:

• Full name (required, min 2 words)
• Email (required, valid format)
• Phone (required, Canadian format)
• Service area dropdown (required, from a predefined list)
• Message (optional, max 500 chars)

I write this list in a plain text file and feed it to Claude Code along with the instruction: "Generate a WordPress form handler that validates these fields server-side and returns JSON error messages for any validation failures."

Step 2: Generate the Form HTML and Handler

Claude Code produces two files: a PHP template for the form HTML, and a handler function that processes the POST request. The form uses native HTML5 validation attributes (required, type="email", pattern for phone numbers) as the first layer of defense, but the real validation happens server-side in PHP.

The handler follows this structure:

function handle_consultation_form() {
  // Verify nonce
  if (!isset($_POST['consultation_nonce']) || 
      !wp_verify_nonce($_POST['consultation_nonce'], 'submit_consultation')) {
    wp_send_json_error(['message' => 'Security check failed']);
  }

  // Sanitize inputs
  $name = sanitize_text_field($_POST['name']);
  $email = sanitize_email($_POST['email']);
  $phone = sanitize_text_field($_POST['phone']);
  $service = sanitize_text_field($_POST['service']);
  $message = sanitize_textarea_field($_POST['message']);

  // Validate
  $errors = [];
  if (str_word_count($name) < 2) {
    $errors['name'] = 'Please enter your full name';
  }
  if (!is_email($email)) {
    $errors['email'] = 'Invalid email format';
  }
  // ... more validation

  if (!empty($errors)) {
    wp_send_json_error(['errors' => $errors]);
  }

  // Send to CRM (next section)
  // Send confirmation email
  // Return success
  wp_send_json_success(['message' => 'Form submitted successfully']);
}

This handler is hooked to wp_ajax_ and wp_ajax_nopriv_ actions so it works for both logged-in users and anonymous visitors. The form submits via AJAX, so there's no page reload — just instant feedback.

Step 3: Connect to External Services

The most valuable part of a custom form handler is what happens after validation. For this law firm, I needed to:

1. Create a new contact in their CRM (they use Pipedrive)
2. Send a confirmation email to the user
3. Notify the firm's intake coordinator via Slack

Each integration is a separate function call inside the handler. For Pipedrive, Claude Code generated the cURL request to hit their REST API:

function send_to_pipedrive($data) {
  $api_key = get_option('pipedrive_api_key');
  $url = 'https://api.pipedrive.com/v1/persons?api_token=' . $api_key;

  $person_data = [
    'name' => $data['name'],
    'email' => $data['email'],
    'phone' => $data['phone'],
    // custom fields for service area, message, etc.
  ];

  $response = wp_remote_post($url, [
    'body' => json_encode($person_data),
    'headers' => ['Content-Type' => 'application/json']
  ]);

  if (is_wp_error($response)) {
    error_log('Pipedrive API error: ' . $response->get_error_message());
    return false;
  }

  return true;
}

The key detail: if the CRM call fails, the form still returns success to the user. The lead data gets logged to a backup file, and I get an email alert. This prevents data loss when an API goes down.

Adding Spam Protection Without Plugins

Spam is the main reason people use form plugins — tools like Akismet and reCAPTCHA are built in. But both of those can be integrated directly into a custom handler with minimal code.

For most clients, I use a three-layer approach:

• Honeypot field — a hidden input that humans don't see but bots fill out. If it's not empty, reject the submission silently.
• Submission timing — log when the form page loads and when it submits. Real users take at least 3 seconds to fill out a form. Bots submit instantly. Reject anything under 2 seconds.
• Akismet API check — for high-risk forms (newsletter signups, open contact forms), I call Akismet's REST API to score the submission. Claude Code generates the request format from their docs.

This stops 99% of spam without adding user friction. For the 1% that gets through, the client can manually review submissions in their CRM.

When to Use This Approach vs. a Plugin

Custom form handlers aren't always the right choice. If you're building a form once, for a low-traffic site, and you don't need CRM integration, Contact Form 7 is probably faster to set up.

But if any of these apply, go custom:

• The form needs to integrate with a CRM, email tool, or internal API
• You're building multiple forms with similar logic (user registration, lead capture, event signup)
• The site gets enough traffic that plugin overhead matters
• The client wants custom post-submission workflows (conditional routing, multi-step processes, dynamic follow-ups)

I've also used this approach to automate other WordPress workflows beyond forms — user onboarding sequences, content migration scripts, and multisite management tools. Once you have the pattern down, it's faster to build custom than to configure a plugin.

What This Looks Like in Practice

For that law firm, the entire system — form, validation, CRM integration, email notifications, spam filtering — took about 4 hours to build and test. They've been using it for six months with zero maintenance. Every lead goes straight into their pipeline, categorized by service area, and their intake coordinator gets a Slack ping within seconds of submission.

Before this, they were using Gravity Forms with a Zapier connection to Pipedrive. It worked, but it was slow (5–10 second delay between submission and CRM record creation), expensive ($20/month for Gravity + $30/month for Zapier), and broke occasionally when Zapier's API rate limits kicked in during high-traffic days.

The custom solution costs nothing to run, processes submissions in under 2 seconds, and has never gone down. That's the difference between using the right tool and using the tool everyone else uses.

Getting Started

If you want to try this on your own site, start with a simple contact form. Define the fields, write out the validation rules, and ask Claude Code to generate the handler. Test it locally first, then add one integration at a time — email notification, then CRM, then Slack or whatever else you need.

The learning curve is minimal if you've ever edited a WordPress theme. And once you've built one custom form, the next ten are almost copy-paste with small tweaks.

For clients who want this level of customization but don't have the technical chops to maintain it, I build and document these systems as part of my WordPress automation service. The goal is always the same: eliminate the plugin tax and give you full control over what happens when a user clicks submit.

If you're tired of fighting form plugins or paying for Zapier to do what PHP can do natively, this is worth exploring. And if you have questions about whether this makes sense for your specific use case, the FAQ page covers most of the common scenarios.