Signup forms and unsubscribe links

A signup form puts a newsletter box, a waitlist or a "tell me when it's ready" form on your site. Visitors type their address, and they land in a PressedMail contact list you can write to.

Signup forms come with every paid plan. The free plugin doesn't include them.

Build a form

1. Open Contacts. Under Lists in the sidebar, pick Signup forms.
2. Press New form and give it a name. Only you see the name.
3. Under Add signups to these lists, pick between one and ten lists. No lists yet? Create one first, see Contacts, lists, and imports.
4. Choose the Fields. Email is always on and always required. First name, last name and company are optional, and each can be required.
5. Set the Consent checkbox text. Whatever it says is saved with each signup, so write what you actually promise.
6. Pick a Layout: Stacked, or Inline with the fields and button on one row.
7. Under After signup, show a message or send people to a page on this site.
8. Save, and check it in Preview.

On your site the form uses your theme's fonts and colours.

Put it on a page

Two ways, same result:

• In the block editor, add the PressedMail signup form block and pick the form.
• Anywhere shortcodes work, paste the shortcode. Copy shortcode on the form gives you the exact one, like [pressedmail_form id="3"].

Any author on the site can embed an active form. Switch a form to Paused and it disappears from every page without losing its settings or the contacts it collected. Deleting a form works the same way for your pages; contacts it already collected stay in your lists.

Double opt-in

Turn on Ask new signups to confirm by email and pick the mailbox under Send the confirmation from. New signups then get one short email with a confirmation link, sent from that mailbox through your provider.

• The address joins your lists only after the link is used.
• The link works for seven days. Unconfirmed signups are deleted after that.
• One address gets at most one confirmation email per form per day, so nobody can use your form to flood someone's inbox.

Stopping spam

Every form has these on, with nothing to set up:

• a hidden field that only bots fill in
• a minimum time between loading the form and sending it
• limits per visitor network and per form

Want more? Add a CAPTCHA. On the Signup forms screen, open Spam protection, pick Cloudflare Turnstile or Google reCAPTCHA v2 (checkbox) and paste the site key and secret key from that provider. Then switch on Use CAPTCHA on each form that should ask for it. If the keys go missing or stop working, those forms refuse every signup until you fix the keys or switch CAPTCHA off, so nothing slips through unchecked.

Unsubscribe links

Every email you send to a contact list carries a signed unsubscribe link in its headers, which some mail apps show as an unsubscribe button. Email templates can also put a personal unsubscribe link in the body.

• Opening a link changes nothing by itself. The reader presses a button to confirm, so link scanners can't opt people out by accident.
• Unsubscribed and unconfirmed contacts are skipped on every later list send, even if your license lapses.
• An unsubscribe sticks. A new signup doesn't undo it, and neither does deleting and re-adding the contact.

Links open a plain page by default. To use your own design, make a page with the Unsubscribe / manage subscription block or the [pressedmail_manage_subscription] shortcode, then pick it as the Unsubscribe page on the Signup forms screen.

What gets stored, and where

Everything stays in your WordPress database:

• the email address and any name or company typed in, saved as a contact of the form's owner
• the consent text the person agreed to, the page they were on and the time

Rate limits keep a keyed hash of the visitor's network, never the IP address itself, for about a day. Unsubscribe requests keep a keyed hash of the address for a day so nobody gets mailed twice. The unsubscribe links are signed with a random key your site generates, not your WordPress salts.

A signup form loads nothing from outside your site unless you turn on CAPTCHA for it. No third-party font or tracker comes with it either way.

With CAPTCHA on, the page with that form loads the provider's widget, and the provider sees the visitor's IP address, browser details and its own cookies:

• Cloudflare Turnstile loads from challenges.cloudflare.com. See Cloudflare's Turnstile privacy policy and terms.
• Google reCAPTCHA v2 loads from www.google.com and www.gstatic.com. See Google's privacy policy and terms.

When someone submits, your site sends the provider only your secret key and the widget's answer to check it. It never sends the visitor's IP address or anything they typed. Saving a secret key also sends it to the provider once, to check it works. Pages without a CAPTCHA form load nothing from either provider.

PressedMail adds suggested text about signup forms to Settings > Privacy, and WordPress's personal data export and erasure tools cover signup records.

Behind Cloudflare, PressedMail sees each visitor's real network. Behind a different proxy you trust, return true from the pressedmail_trust_proxy_headers filter, or every visitor shares one rate limit.

If your license lapses

Forms stop showing on your pages, and the contacts they collected stay put. People who unsubscribed stay unsubscribed. If you switch back to the free plugin, the shortcode shows up as plain text, so remove it from your pages.