Ninja Forms Review 2026: Is the Free Version Enough?
The Ninja Forms builder with the field panel open on our test install, version 3.15.5, October 2026.
Our verdict: Ninja Forms is one of the best free form plugins for WordPress if your forms are straightforward. The free version saved every entry, ran a live price calculation, exported to CSV, and blocked a spam bot on our test site. WPForms Lite, its best-known free rival, does not save entries or run calculations at all. It stops at the features many forms eventually need: conditional logic, file uploads and real multi-step forms all cost extra. Choose it for contact, quote and registration forms on a budget. If you already know you need those paid features on one site, Gravity Forms is often the better deal.
This review is based on a fresh install of the free plugin, where we built three real forms, plus the vendor’s pricing page, the WordPress.org listing, and public vulnerability databases, all checked in October 2026.
Ninja Forms Quick Facts
| Item | Details |
|---|---|
| Made by | Saturday Drive, Inc. (on WordPress.org since December 2011) |
| Latest version | 3.15.5 (released September 28, 2026) |
| Active installs | 500,000+ on WordPress.org |
| Rating | 4.4 out of 5 from 1,395 reviews |
| Requirements | WordPress 6.9 and PHP 7.4 or newer |
| Free version | Yes, with unlimited forms, submissions and sites |
| Paid plans | Plus $59.40 first year, then $99/year (3 sites); Pro $119.40, then $199/year (20 sites); Elite $299.40, then $499/year (unlimited sites) |
| Single add-ons | $29 or $49 per year each for one site |
| Refund window | 14 days |
| Not in the free version | Conditional logic, file uploads, multi-step forms, layout and styling tools, payments, CRM and email marketing connections |
| Security history | 81 vulnerabilities listed by WPScan since 2014, all fixed in later versions; 13 published in 2026 |
| Best suited for | Small business sites that want a capable free form plugin and will buy features only when needed |
Prices and numbers are as of October 2026.
What Is Ninja Forms?
Ninja Forms is a drag-and-drop form builder for WordPress. The core plugin is free on WordPress.org and has been around since 2011. Its business model is different from most rivals: instead of a “Lite” version with a “Pro” version, you keep the same free plugin and add paid features as separate add-ons, either one at a time or in a yearly bundle.
That makes the free plugin unusually complete. What it leaves out are the features that make a form react to answers or collect files.
How We Reviewed Ninja Forms
We installed the free plugin (version 3.15.5) on a test site running WordPress 7.1.2 and the Twenty Twenty-Five theme in October 2026 and built three forms a small business would actually use:
- A contact form with name, email, phone, a topic dropdown and a message box.
- A quote request form with 13 fields, including checkboxes, radio buttons, a number field, a date picker and a live price estimate.
- A workshop registration form laid out as three “steps” using headings and dividers, with a confirm-email field, a signature field and a cap of 20 registrations.
Then we submitted entries as a logged-out visitor, exported them, tried the spam tools, and measured what each form adds to the page. The paid add-ons are covered from the vendor’s published details, since we did not buy them.
Setting Up and Building Forms
Ninja Forms installed and activated in seconds and created a sample “Contact Me” form on its own. The first time we opened its dashboard, a pop-up asked to collect usage data, with a pre-unticked box for marketing emails. “Not Now” closed it.
Templates. The “Add New” screen offers a blank form, 10 free templates (Contact Us, Quote Request, Event Registration, Job Application, GDPR data requests and more) and 7 more that need paid add-ons, such as Stripe Payment and File Upload. There is also a “Build with AI” option. On our test site it showed a “Connect an AI provider” message, because it uses the Anthropic or OpenAI connection you set up in WordPress, under your own account. We did not connect one, so we could not try it. A setting lets you turn the AI features off completely.
The builder. It opens full screen with three tabs: Form Fields, Emails & Actions, and Advanced. You click a field type in a slide-out panel to add it, click a field to edit it, and drag to reorder. New fields land below the Submit button, so you drag almost every one into place, which gets tedious on long forms.
Editing a dropdown’s options and calc values in the quote form on our test install, version 3.15.5, October 2026.
The contact form was the quickest: we started from the Contact Us template, added a phone field and a topic dropdown, dragged them into place, changed the success message, and switched the notification email to send all fields. The template already came with four actions: save the submission, email the visitor a copy, email the site admin, and show a success message.
The quote form shows where Ninja Forms is stronger than most free plugins. Each dropdown and checkbox option can carry a “calc value”. We gave the services and extras prices, wrote one formula in the free Calculations panel (service + extras + pages × 150), and showed the result in an HTML field. On the live page, the estimate updated as we picked options: $1,000 for a redesign, then $2,950 after adding copywriting, a logo and 8 pages. Building it took about four minutes from blank form to published.
The registration form started from the Event Registration template. We relabelled the fields, added a Confirm field that checks the two emails match, a Signature field, and a required agreement checkbox. Under Advanced, then Restrictions, we made the email field unique and limited the form to 20 submissions. When we submitted the same email twice, the second attempt was blocked with our custom message. One small thing: the template’s food question spells “Vegetarian” as “Vegitarian” until you fix it.
What the Free Version Includes, and Where It Stops
Here is what we counted in the free builder on our test site:
| Area | Free | Locked |
|---|---|---|
| Field types | 31 of 33, including Signature, Star Rating, Repeatable Fieldset, Date/Time, hCaptcha, reCAPTCHA and Turnstile | File Upload, Save |
| Actions (what happens after submit) | 7 of 41: Email, Success Message, Redirect, Record Submission, Google Analytics 4, and two GDPR data request actions | 34, including payments, Zapier, webhooks, every email marketing service and CRM, and user registration |
| Advanced settings | 3 of 9: Display Settings, Restrictions, Calculations | Conditional Logic, Multi-Part, Save Progress, Styles, PDF Submissions, Scheduled Exports |
| Templates | 10 | 7 |
The action panel on our test install: seven core actions are free, the rest need add-ons. Version 3.15.5, October 2026.
The biggest gap is conditional logic. Without it, every visitor sees every field, so you cannot hide an “Order number” box unless someone picks “Order support”. Our Gravity Forms review ran exactly that test and neither free plugin could do it. The registration form’s “steps” are also only visual: real one-page-at-a-time forms with a progress bar need the Multi Step Forms add-on.
File uploads are the other common blocker. Job applications, support forms with screenshots and photo contests all need the File Uploads add-on.
Styling is basic. Forms inherit your theme’s look. On Twenty Twenty-Five the inputs looked plain and small, and the form title appeared below the page title, so the same heading appeared twice. You can turn off the form title in Display Settings. Matching a brand closely means CSS or the $49 Layout and Styles add-on.
Actions, Submissions and CSV Export
All four free “after submit” actions worked on our test site:
- Success message. The contact form showed “Thanks Dana Rivera, we got your message…” using a merge tag (a placeholder like
{field:name}that fills in the visitor’s answer). - Redirect. We turned off the success message on the quote form and added a redirect. After submitting, the browser went straight to our “Thank You” page.
- Save submission. Every entry appeared on the Submissions screen, where you pick a form, filter by date, search, edit, or trash entries.
- Email. Notification and confirmation emails were set up, and submissions went through without errors. Our test site does not send real mail, so we did not confirm delivery. If you rely on emails, a mail delivery plugin or service is a good idea; Ninja Forms promotes its partner SendWP inside the plugin.
Saved contact form entries and the CSV download confirmation on our test install, version 3.15.5, October 2026.
The “Download All Submissions” button produced a CSV file named after the form, with a row per entry and a column per field. One quirk: dropdown answers were exported as their internal values (“order-support”) rather than the labels visitors saw (“Order support”). You can edit the values in each option’s settings, but it is worth knowing before you hand a spreadsheet to someone else. Excel files and scheduled exports are paid add-ons.
The contact form CSV export from our test install, viewed as a table and as raw text, October 2026.
Spam Protection in the Free Version
Ninja Forms is generous here. The vendor calls it “multi-layer spam protection”, and on our test site it included:
- A honeypot on every form. This is a hidden field that people never see but bots fill in. It is added automatically. When we filled it in with a script and submitted, the form refused with “Honeypot Error”.
- reCAPTCHA v2 and v3, hCaptcha and Cloudflare Turnstile. Each has a field type and a settings section for your keys. We left the keys empty because getting them means signing up with each service.
- An Anti-Spam question field. You set a question and answer, such as “What is 2 + 3?”.
- Akismet. Ninja Forms includes an Akismet action, but it only appears when the Akismet plugin is active with a valid API key. We activated Akismet without a key and the action stayed hidden, so we could not test it.
- Restrictions. Unique fields, logged-in-only forms and submission limits help against duplicate entries.
Page Speed: What Ninja Forms Loads
We loaded each test page as a logged-out visitor and counted the CSS and JavaScript files. The sizes below are as served by our test site; the gzip figures are what a server that compresses files would send.
| Page | CSS files | JavaScript files | Total size | With gzip |
|---|---|---|---|---|
| Page with no form | 0 | 3 | 64 KB | about 21 KB |
| Contact form | 1 | 9 | 419 KB | about 122 KB |
| Quote form (with date picker) | 2 | 10 | 542 KB | about 157 KB |
| Registration form (with signature) | 3 | 37 | 1,831 KB | about 571 KB |
A few things stand out:
- Assets load only on pages with a form. The page without a form loaded nothing from Ninja Forms.
- The plugin needs jQuery, Backbone and Underscore. A simple contact form added one stylesheet and six scripts, about 100 KB once compressed.
- The Signature field is heavy. In the plugin’s code, the signature field is built with React, so adding it pulled in React and WordPress’s full component library. Our other form pages loaded 10 to 12 files; the page with the signature field loaded 40. Leave it out unless you really need signatures.
- The form is drawn by JavaScript. The page’s HTML contains the form as a template, and visitors with JavaScript turned off see “JavaScript is required for this content” instead of a form.
The markup itself is solid: every field in our contact form had a proper label, required fields were marked with aria-required, and error messages sit in regions that screen readers announce. The vendor describes its forms as accessibility-first.
Ninja Forms Pricing
You can pay in two ways: buy single add-ons, or buy a yearly plan that bundles them. Prices below are from the Ninja Forms pricing and add-on pages as of October 2026, in US dollars.
| Plan | First year | Renewal | Sites | What it adds |
|---|---|---|---|---|
| Core | Free | Free | Unlimited | The free plugin |
| Plus | $59.40 | $99/year | 3 | Conditional Logic, File Uploads, Multi Step Forms, Layout & Styles, Conversational Forms, PayPal, 10 email marketing services (16 add-ons) |
| Pro | $119.40 | $199/year | 20 | Plus, and Stripe, Authorize.net, Elavon, Advanced Datepicker, Save Progress, User Management, HubSpot, Salesforce, Zoho CRM, Zapier, Slack, Trello (28 add-ons), plus 40% off other add-ons |
| Elite | $299.40 | $499/year | Unlimited | Every add-on, including Webhooks, PDF Form Submission, Excel Export and SMS, plus future add-ons |
What to know before you buy:
- The discount is first-year only. The pricing page shows each plan at 40% off for the first year, then full price. Plans auto-renew yearly.
- Single add-ons are $29 or $49 a year for one site. Conditional Logic, File Uploads, Layout and Styles, PDF Form Submission and Webhooks are $49; most others, including Stripe, PayPal, Mailchimp and Multi Step Forms, are $29. Options for 5 and 20 sites are offered too.
- A single add-on can be the cheapest route. If all you need is conditional logic on one site, $49/year is less than Plus at renewal. Over two years that is $98, if the price stays the same, compared with $118 for Gravity Forms Basic and $158.40 for Ninja Forms Plus. Once you need two or three of the $49 add-ons, Plus is cheaper.
- Refunds. Every purchase has a 14-day money-back guarantee. There are no demos of the add-ons, and that is the only way to try them.
- If you cancel, add-ons keep working, but you stop getting updates and support. Given the security history below, running add-ons without updates is not a good idea.
- Support is open to free users too, on weekdays from 9am to 4pm Eastern.
The Add-ons screen inside WordPress on our test install, listing 43 add-ons, version 3.15.5, October 2026.
Upgrade prompts in the free version
The upsells add up. On our test site we saw the data-collection pop-up on first use, a large “How’s It Going?” notice on every admin screen (including the main dashboard) until dismissed, a builder tooltip advertising the Layout and Styles add-on on every form, the locked fields, actions and Advanced boxes above (clicking a locked action opened its sales page in a new tab), an Add-ons tab, and a “User access” tab that is an ad for the User Management add-on. A setting turns off all Ninja Forms admin notices.
Ninja Forms Security History
Form plugins handle visitor input, which makes them a frequent target. Here is a summary from WPScan, Wordfence Intelligence, Patchstack and the official changelog, as of October 2026:
- Overall: WPScan lists 81 vulnerabilities in the core plugin since 2014, and Patchstack lists 74 as patched. Every entry we checked had a fixed version.
- June 2022 (critical): An unauthenticated PHP object injection flaw (CVSS 9.8, near the top of the 10-point severity scale) was fixed in version 3.6.11, with fixes back-ported to older branches. Wordfence reported evidence that it was being exploited, and WordPress.org pushed a forced automatic update to affected sites.
- April 2026 (critical, paid add-on): The separate File Uploads add-on had an unauthenticated arbitrary file upload flaw (CVE-2026-0740, CVSS 9.8) in versions up to 3.3.26. According to Wordfence, the vendor released the fully patched version on March 19, 2026, attacks started on the day of public disclosure, April 6, and Wordfence blocked over 118,600 attempts. Version 3.3.27 was the latest at the time.
- June to October 2026 (core plugin): WPScan published 11 issues in the core plugin, several exploitable without logging in: information disclosure through a REST endpoint (fixed in 3.14.2), shortcode execution (fixed in 3.14.10 and 3.15.2), stored cross-site scripting through repeater fields (3.15.2), stored cross-site scripting and PHP object injection through the CSV export (3.15.4), and stored cross-site scripting through the rich text Paragraph field (3.15.5, published October 1). WPScan rates five of them high severity and the rest medium.
The positives: fixes have shipped quickly, the changelog names the researchers who reported issues, and Saturday Drive publishes a responsible disclosure policy. The practical advice is simple. Turn on automatic updates for Ninja Forms and any add-ons, renew add-on licenses so you keep getting fixes, and test big updates on a staging site if your forms are business critical. Outdated plugins are one of the common ways sites end up with problems like a spam link injection.
Ninja Forms vs WPForms vs Gravity Forms
These are the three plugins people compare most. The Ninja Forms and WPForms details come from our test installs; Gravity Forms has no free version, so its column is based on the vendor’s published details, as covered in our Gravity Forms review.
| Ninja Forms | WPForms | Gravity Forms | |
|---|---|---|---|
| Free version | Yes (3.15.5) | Yes, WPForms Lite (2.0.2.1) | No |
| Entries saved in the free version | Yes | No, email only | No free version |
| Calculations | Free | Pro plan and up | Every license |
| Conditional logic | $49 add-on or Plus plan | Basic plan and up | Every license |
| File uploads | $49 add-on or Plus plan | Basic plan and up | Every license |
| Stripe payments | $29 add-on or Pro plan | Free with a 3% fee | Pro license ($159/year) |
| Cheapest paid plan | $59.40 first year, then $99 (3 sites) | $49.50 first year, then $99 (1 site) | $59/year (1 site) |
| Refund window | 14 days | 14 days | 30 days |
- Ninja Forms vs WPForms: Choose Ninja Forms for a free plugin that keeps entries and calculates totals. Choose WPForms if you want the friendlier builder, a far larger template library, or Stripe payments without buying anything. Both free versions have built-in spam protection and support reCAPTCHA, hCaptcha and Turnstile.
- Ninja Forms vs Gravity Forms: Choose Ninja Forms if the free version covers you, or you need just one paid feature. Choose Gravity Forms if you need conditional logic, file uploads and multi-page forms together, since one $59 license includes them all and its price does not rise at renewal.
For more options, including Formidable Forms and Fluent Forms, see our guide to the best WordPress form plugins and our list of Gravity Forms alternatives.
Ninja Forms Pros and Cons
Pros
- Free version saves submissions, exports CSV, and includes calculations, signatures and submission limits.
- Honeypot on every form, plus free reCAPTCHA, hCaptcha and Turnstile fields.
- Buy single add-ons instead of a whole plan.
- Accessible markup with proper labels and error announcements.
- Loads its files only on pages that contain a form.
Cons
- Conditional logic, file uploads and true multi-step forms cost extra.
- New fields drop below the Submit button, so long forms take a lot of dragging.
- Forms need JavaScript, and the Signature field adds a lot of page weight.
- Persistent upgrade prompts in the free version.
- A long vulnerability history, with a cluster of fixes in 2026, so updates matter.
- First-year prices rise at renewal.
Verdict: Is Ninja Forms Worth It in 2026?
For a free form plugin, yes. On our test site it handled a contact form, a quote form with a live estimate, and a capped registration form without spending anything, and it kept every entry in WordPress. That is a better free deal than WPForms Lite for most small business sites.
Paying for it makes sense in narrower cases: when you need one feature such as conditional logic on one site, or when you run up to 20 sites and want Stripe and CRM connections on the Pro plan. If you need several advanced features from day one, compare the two-year cost with Gravity Forms first. Whatever you choose, keep Ninja Forms and its add-ons updated.
FAQ
Is Ninja Forms free?
Yes. The core plugin is free on WordPress.org with unlimited forms, submissions and sites. Features such as conditional logic, file uploads, multi-step forms, payments and CRM connections are paid add-ons or part of a paid plan.
How much does Ninja Forms cost?
As of October 2026, plans cost $59.40 for the first year and then $99/year for 3 sites (Plus), $119.40 then $199/year for 20 sites (Pro), and $299.40 then $499/year for unlimited sites (Elite). Single add-ons cost $29 or $49 a year for one site.
Does Ninja Forms have conditional logic and file uploads for free?
No. Both are paid. You can buy each as a $49/year add-on for one site, or get both in the Plus plan. On our test install, the Conditional Logic box and the File Upload field were greyed out in the free version.
Can Ninja Forms take payments?
Not in the free version. PayPal comes with the Plus plan, and Stripe, Authorize.net and Elavon with Pro. You can also buy a single payment add-on, such as Stripe for $29/year.
Is Ninja Forms safe to use?
It is actively maintained and fixes reported issues quickly, but it has a long vulnerability history: 81 entries on WPScan, including a critical flaw fixed in 2022 and 13 issues published in 2026, all with fixed versions. Keep it and any add-ons updated, ideally with automatic updates.
Is Ninja Forms better than WPForms?
For a free plugin, Ninja Forms does more: it saves entries in WordPress and runs calculations, which WPForms keeps for its Pro plan. WPForms has the easier builder and many more templates, and lets you take Stripe payments for free with a 3% fee.