Webhook Integration — Connect Any App
Form Forge’s webhook integration sends every form submission to any external URL as a JSON payload. Use it to connect forms to Zapier, Make (formerly Integromat), n8n, your own API endpoint, or any service that accepts HTTP POST.
How webhooks work in Form Forge
Per-form webhook URL
Every form has a Webhook setting in the integrations panel. Enter the destination URL and Form Forge posts the submission to it after every successful submission.
JSON payload
The payload is a JSON object containing:
form_id— the Form Forge form IDform_title— the human-readable form titlesubmission_id— a unique ID for this submissionsubmitted_at— ISO 8601 timestampsource_url— the page URL the form was submitted fromip_address— submitter’s IP (hashed if configured)user_agent— submitter’s browserfields— an object mapping field IDs to their values
Custom headers
Add custom HTTP headers to the request — useful for authentication:
Authorization: Bearer your-api-token
X-API-Key: your-key-here
Content-Type: application/jsonHeaders are stored encrypted in the WordPress database.
Retry on failure
If the webhook endpoint returns a non-2xx status or times out, Form Forge retries up to 3 times with exponential backoff (1 second, 5 seconds, 30 seconds). Permanently failed webhooks are logged in the admin so you can investigate.
Background execution
Webhooks run via the Forge Queue, not synchronously in the submission flow. A slow external endpoint won’t block the user’s “Thank you” page from appearing.
Security: SSRF protection
Server-Side Request Forgery (SSRF) is a common web vulnerability where an attacker tricks your server into making requests to internal network addresses or cloud metadata endpoints. Without protection, someone could configure a webhook to point at http://localhost/ or http://169.254.169.254/ (AWS metadata) and extract information from your infrastructure.
Form Forge’s webhook integration blocks:
- Private IPv4 ranges (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16)
- Loopback (127.0.0.0/8)
- Link-local (169.254.0.0/16)
- IPv6 equivalents
- Non-HTTP(S) schemes
- Redirects to private IPs
The destination URL is resolved and validated before the request is sent. Attempts to hit forbidden addresses are rejected and logged.
Use cases
Zapier or Make
Connect Form Forge submissions to Zapier / Make workflows that trigger any of their thousands of integrations. Create records in Airtable, send SMS via Twilio, add rows to Google Sheets (via Zapier, if you prefer over the native Google Sheets integration), and more.
Custom backend
POST submissions to your own REST API for processing — scoring leads, running business logic, syncing to your CRM, triggering custom workflows.
n8n self-hosted automation
If you run n8n on your own infrastructure, Form Forge can POST to your n8n webhook endpoint and trigger complex automations without giving up data control.
Discord / Slack alerts (custom format)
While Form Forge has native Slack and Discord integrations with Block Kit / Embed formatting, sometimes you want a custom format. Point the webhook at a Slack/Discord webhook URL and format the payload your way via a simple webhook receiver.
Your own database
POST to a serverless function (AWS Lambda, Cloudflare Workers, Vercel) that writes the submission to your own database. Keeps form data in your infrastructure, not WordPress.
Testing webhooks
Form Forge’s admin includes a Test Webhook button that sends a sample payload to your configured URL. The response code and body are displayed so you can verify the endpoint is responding correctly before real submissions start flowing.
Webhook logs
The Form Forge admin keeps a log of every webhook request:
- Timestamp
- Destination URL
- Response code
- Response body (truncated)
- Number of retries
- Final status (success / failed)
You can replay failed webhooks manually from the log.
Ready to connect your forms to any app?
Webhook integration is included in every plan — free and paid. No add-on, no separate subscription.