Skip to content
OctaForms

Production checklist

OctaForms works out of the box, but a few production concerns decide whether leads arrive reliably. Go through this list before you depend on a form.

1. Run a real cron

Section titled “1. Run a real cron”

WP-Cron only runs when someone visits the site, and some hosts starve it further with page caches. That delays delivery of anything not sent inline. Run a real system cron every minute:

Terminal window
wp octa-forms queue drain

This bypasses the WP-Cron machinery entirely. Site Health shows a red status when the queue worker has not run for 15 minutes or more. This is important enough to have its own page: Cron and the delivery queue.

2. Set up proper email

Section titled “2. Set up proper email”

WordPress reporting “sent” only means your server accepted the message, not that it arrived. Use an SMTP plugin and send from a domain with valid SPF and DKIM. Set each form’s sender address to your own domain. Full details in Email deliverability.

3. Exclude the token endpoint from cache

Section titled “3. Exclude the token endpoint from cache”

Your page cache or CDN must not cache /wp-json/octa-forms/v1/token. The endpoint already sends Cache-Control: no-store, private, but your cache layer needs its own explicit rule. A cached token breaks submissions.

4. If you are behind a proxy or CDN

Section titled “4. If you are behind a proxy or CDN”

If your site sits behind Cloudflare or a similar proxy, the visitor’s real IP arrives in a header. For rate limiting and spam forensics to work correctly and safely:

  • Set the client IP source in the settings.
  • List your provider’s IP ranges as trusted proxies. Without this, the header is ignored, because otherwise anyone could spoof it.
  • Firewall your origin so traffic can only reach it through the CDN.

5. Understand webhooks are at-least-once

Section titled “5. Understand webhooks are at-least-once”

If you use webhooks, the receiver must deduplicate on the payload’s id and verify the signature against the raw body. See Webhooks.

6. Large multisite networks

Section titled “6. Large multisite networks”

On very large networks, automatic per-site iteration is skipped during activation and uninstall. Use WP-CLI per site instead. Tables and cron events self-heal on each site as they are used.

Keep an eye on Site Health

Section titled “Keep an eye on Site Health”

OctaForms adds a dedicated “delivery queue” test to Site Health, covering the backlog, the worker heartbeat, the inline circuit breaker, and a loopback self-test of the token endpoint. Check it after going live, and it will tell you if any of the above is not set up right.