How to Create an Anonymous Feedback Form in WordPress

Removing the name and email fields does not make a WordPress form anonymous. The submission may still contain an IP address, user agent, referrer URL, logged-in account, analytics identifiers, or data sent to another service.

Call the form anonymous only after you have traced every identifier. Until then, “confidential feedback” is the more accurate promise.

Anonymous vs confidential feedback

Anonymous feedback cannot reasonably be connected to the respondent. Confidential feedback can be connected, but access is restricted and the organization promises to protect it.

That difference changes the form copy:

Anonymous: We do not collect information that identifies you.

Confidential: Your response is visible only to the review team. We may contact you if you choose to provide an email address.

The first statement is much harder to prove. A WordPress form can omit identity fields while the server still records technical metadata.

What Core Forms stores by default

Core Forms submissions include the submitted field data plus IP address, browser user agent, referrer URL, status, and timestamp. The submissions documentation lists the database columns and what administrators can see.

Core Forms analytics use a different privacy model. The analytics dashboard stores a hashed IP with a daily rotating salt for visitor counting, but the form submission record itself stores the submitter IP address.

So a default Core Forms submission with no name field is not fully anonymous.

Choose the privacy promise first

For most customer feedback, use a confidential form:

• remove required identity fields;
• make email optional;
• limit WordPress access to the review team;
• state how long responses are retained;
• avoid sending the full response to Slack or email;
• aggregate findings before sharing them.

For employee complaints, whistleblowing, health, safeguarding, or legal reports, do not improvise. The technical form is only one part of the reporting system. Get privacy, security, and legal review.

Build the form

Start from the feedback or survey template. Use a rating field, a small number of multiple-choice questions, and one textarea for the explanation.

A useful confidential feedback form might ask:

1. Which part of the experience does this concern?
2. How serious is the issue?
3. What happened?
4. What outcome would help?
5. May we contact you? (Yes/No)
6. Email address, shown only when “Yes” is selected.

Use conditional logic for the optional email branch. Hidden conditional fields are excluded from submitted data and validation, so a respondent who selects “No” does not send an empty identity field.

For sensitive questions, multi-step forms can show one question at a time. This changes presentation, not privacy.

Reduce accidental identification

Even without technical metadata, open text can identify a person:

“During the 3:00 PM meeting with the only two people from finance…”

Tell respondents not to include names or details they do not want recorded. If follow-up is optional, separate the contact field from the main narrative in your review process.

Also inspect every action:

• An Email action can copy the complete response into several mailboxes.
• A Slack integration can expose it to a channel.
• A webhook can send it to a CRM or automation platform.
• An autoresponder proves the organization received an email address.

For a privacy-sensitive form, fewer actions are safer. Store the response once, notify reviewers that a new record exists, and make them open the protected submissions inbox.

Control access and retention

The Core Forms REST submission endpoints require the edit_forms capability, and the admin inbox follows the same permission boundary. Give that capability only to people who need individual responses.

Set an operating rule for deletion. For example:

• triage new submissions within two working days;
• remove spam immediately;
• aggregate themes monthly;
• delete individual responses after 90 days unless an active case requires them.

WordPress privacy exporters and erasers can process personal data connected to an email address, but an anonymous response has no email key. That is another reason to define retention before collection.

If you need stronger anonymity

A stronger setup requires code and infrastructure review. You may need to prevent storage of IP address and user agent, disable identifying integrations, avoid logged-in forms, adjust server logs, review CDN logs, and test analytics cookies.

Core Forms exposes hooks for changing processing behavior, but a single filter cannot promise anonymity across WordPress, the web server, Cloudflare, backups, and connected services.

State only what you have verified.

FAQ

Does removing name and email make a form anonymous?

No. IP address, user agent, account state, referrer, analytics, server logs, open-text details, and integrations may still identify the respondent.

Does Core Forms store IP addresses?

Yes. The default submission record includes the submitter’s IP address, user agent, and referrer URL. Analytics separately use a daily salted IP hash.

Can an anonymous feedback form allow follow-up?

You can make contact details optional, but a response with an email address is confidential rather than anonymous.

Should sensitive feedback be emailed?

Avoid emailing the full response. Send a minimal alert and require authorized reviewers to open the protected submissions inbox.

Can Core Forms be customized for stronger privacy?

Developers can use hooks and custom processing, but they must review the whole request path, including hosting, CDN, logs, backups, analytics, and integrations.