Skill level: Beginner–Intermediate
Time to complete: 5–15 minutes
Prerequisites: A CPT created or registered via CPT CSV Importer
What You’ll Learn
- How to place the submission form on any page
- How to control who sees the form (anonymous, logged-in, or all users)
- How the form fields are built automatically from your CPT definition
- How spam protection works
- How submitters can edit their records in the future
- How confirmation and notification emails work
Overview
Once you have a CPT registered through CPT CSV Importer, you can immediately start collecting new records from your site’s visitors — no form builder needed. Drop a shortcode on any page and the form is generated automatically from your CPT’s field definitions.
This is ideal for:
- Business directories — let owners submit and update their own listing
- Event calendars — let organisers add events without admin access
- Resource libraries — let members contribute documents, tools, or links
- Lead capture — collect prospect information without exposing the WordPress dashboard
The Shortcode
[cpt_submit_form post_type="your_cpt_slug" show="all"]
Place this shortcode in the content of any page, post, or widget area that supports shortcodes.
Attributes
| Attribute | Required | Values | Default | Description |
|---|---|---|---|---|
post_type | Yes | Any CPT slug | — | The post type to submit records to |
show | No | logged_out, logged_in, all | logged_out | Controls which users see the form |
The show Attribute Explained
| Value | Who sees the form |
|---|---|
logged_out | Only visitors who are not logged in — once they log in, the form disappears |
logged_in | Only visitors who are logged in — anonymous visitors see nothing |
all | Everyone sees the form, regardless of authentication status |
Tip: Use show="logged_out" for public registration-style forms where you don’t want existing users to double-submit. Use show="all" for open contribution forms like directories or resource submissions.
How Form Fields Are Generated
The form is built automatically from your CPT’s field_order configuration (set in Tools → CPT CSV Importer → Manage Fields).
Field Types and Their Inputs
| Field type | Rendered as | Notes |
|---|---|---|
| Post Title | Text input | Always first; always required |
| Meta field | Text input | Standard single-line text |
| Meta field (key contains “email”) | Email input | Validated as email address format |
| Taxonomy (single-value) | Select dropdown | Search-enabled via Select2 |
| Taxonomy (multi-value) | Multi-select dropdown | Select multiple terms; search-enabled |
All taxonomy dropdowns show existing terms from your database. New terms can only be created via CSV import or the WordPress admin — the frontend form lets users pick from existing options only.
Logged-In User Email Behaviour
If your CPT has a meta field with “email” in the key name (e.g., contact_email, user_email):
- For logged-in users, this field is automatically pre-filled with their WordPress account email address
- The field is made read-only — the user cannot change it
- A note appears below: “Your account email address”
This ensures you always have a verified email for authenticated submissions, which is essential if you plan to send edit links back to the submitter.
Spam Protection
Two layers of spam protection are applied to all form submissions — no CAPTCHA plugin required:
1. Honeypot Field
A hidden field named _confirm_email is included in the form markup. Legitimate users never see or interact with it. Most automated bots fill in every field they find — if this field contains any value, the submission is silently discarded. The user sees a success message, but no post is created.
2. Timing Check
A hidden timestamp is embedded in the page at load time. If the form is submitted within 20 seconds of the page loading, it is rejected with an error message. Legitimate humans take longer to fill out a form; automated scripts typically submit instantly.
Neither of these protections is foolproof against sophisticated bots, but together they handle the vast majority of automated spam without any friction for real users.
What Happens When Someone Submits
- The nonce is verified (prevents cross-site request forgery)
- The honeypot check runs
- The timing check runs
- All field values are sanitised
- If the post title is left empty, an auto-title is generated:
Submission YYYY-MM-DD HH:MM - A new WordPress post is created with status Draft (not publicly visible until you publish it)
- Meta values are saved
- Taxonomy terms are assigned
- If editing is enabled, a unique private edit token is generated and stored
- An admin notification email is sent to the site admin email address
- A confirmation email is sent to the submitter (if Confirm Submission is enabled and an email field is present)
After a successful submission the user sees a success message in place of the form. If a redirect URL has been provided on this post types settings screen it will redirect to that page instead.
Reviewing Submissions in the Admin
Submissions arrive as Drafts. To find them:
- In the admin sidebar, navigate to your CPT (e.g., “Business Listings”)
- Click Draft in the status filter at the top of the list table
- Review each submission and publish, edit, or delete as appropriate
You will also receive an admin notification email for each new submission with a direct link to the draft in your admin.
Letting Submitters Edit Their Own Records
This feature allows a submitter to return at any time and update their record — without needing a WordPress account.
How to Enable It
- Go to Tools → CPT CSV Importer → Registered Types
- Click Settings next to your CPT
- Check Confirm Submission (required for edit links to be sent)
- Check Allow Editing
- Save
You must also have at least one meta field with “email” in the key name — this is where the edit link gets sent.
How It Works for the Submitter
- Submitter fills in and submits the form
- They receive a confirmation email containing a private edit link — a URL with a unique 48-character token, e.g.:
https://example.com/submit-page/?edit_token=a3f4b9c2... - Clicking the link opens the same submission form, pre-filled with their existing data
- They make changes and submit
- The existing post is updated — no duplicate is created
- They receive a new confirmation email noting the update
The email includes a note: “Please do not share this link” — since anyone with the link can edit that record.
Edit Token Details
- Tokens are 48 characters of cryptographically random hex (generated with
random_bytes()) - Stored as
_cpt_edit_tokenpost meta - Tokens never expire — the edit link remains valid indefinitely
- There is no limit on the number of edits a submitter can make
Confirmation Email Content
New Submission Email (to submitter)
Sent when:
- Confirm Submission is enabled in CPT Settings
- The submitted form included a value for an email-type meta field
Subject: Thank you for your {CPT Name} submission
Body includes:
- A confirmation message
- A summary of submitted field values
- If editing is enabled: the private edit link with a “do not share” note
Update Email (to submitter, on edit)
Sent when a submitter returns via their edit link and updates their record.
Subject: Your {CPT Name} record has been updated
Body includes:
- A confirmation message
- A summary of the updated field values
Admin Notification Email
Sent to the WordPress admin email address for every new submission (not for edits).
Subject: New {CPT Name} submission: {Post Title}
Body includes:
- A field-by-field summary of the submission
- A direct link to the post in the WordPress admin
Example: A Business Directory Form
Scenario: A business directory CPT with fields:
- Business Name (title)
- Category (taxonomy)
- Phone Number (meta:
phone_number) - Contact Email (meta:
contact_email) - Website (meta:
website)
Shortcode on your “Submit a Listing” page:
[cpt_submit_form post_type="business_listings" show="all"]
Settings:
- Confirm Submission: ✅ Enabled (uses
contact_emailfield) - Allow Editing: ✅ Enabled
Workflow:
- Business owner visits the “Submit a Listing” page
- Fills in their details and hits Submit
- They receive a confirmation email with their listing summary and an edit link
- Admin receives a notification and publishes the listing after review
- Business owner can return via their edit link any time to update their phone number, website, etc.
Troubleshooting
The form shows an error after submission
- Check that the nonce is being generated correctly (caching plugins can serve stale nonces — exclude the page from cache or use a cache-busting solution)
- Ensure the page isn’t cached before the form has loaded (timing check requires the page to actually load in the browser)
The form says “Post type not found”
- Verify the
post_typeshortcode attribute exactly matches the CPT slug - Confirm the CPT is visible in the Registered Types list at Tools → CPT CSV Importer
Taxonomy dropdowns are empty
- Terms are only shown if they already exist in the database
- Run a CSV import first to create terms, or add terms manually via the CPT’s taxonomy admin screen
Confirmation emails aren’t being sent
- Check that Confirm Submission is enabled in CPT Settings
- Ensure at least one meta field key contains the word “email”
- Check your server’s mail sending configuration — use an SMTP plugin if
wp_mail()isn’t delivering
Edit link not working
- The token is stored as post meta
_cpt_edit_token— verify it was saved by checking the post’s custom fields in the admin - Ensure the URL in the email points to the correct page (the page where the shortcode is placed)
- Check Allow Editing is enabled in CPT Settings
Next Steps
- Field Management, Settings, and Email Configuration — control field order, required flags, and configure confirmation emails
- Getting Started: Import or Create a CPT from CSV — if you haven’t set up your CPT yet