Form display is served static; submission is bridged through admin-ajax.php, the same mechanism WPForms itself uses for submissions.
Static + Bridges
The page containing the form is served from the static release.
Only the actual submission request is dynamic.
Submissions are bridged via admin-ajax.php.
No special setup — detected automatically for either the free or Pro plugin.
WPForms submits through the general admin-ajax.php endpoint rather than a scoped route of its own, which is a slightly wider bridge surface than ideal — this is a known, documented limitation of how WPForms itself is built, not something Static Shield can narrow further without WPForms changing its submission mechanism. As with the other form plugins, a real submission sends a real notification, so the submission path is validated manually rather than automated.
Static Shield Lite is free to install and inspects your actual plugins, not just what's publicly visible.
Get Static Shield
Tulapp