OptinFlare – Popup & Opt-in Forms

OptinFlare is a popup builder and opt-in form plugin for WordPress. Design newsletter signup forms, exit-intent popups, slide-in fly-ins, inline forms and sticky bars in a visual editor, then show them at the right moment to grow your email list and generate more leads.

No account and no external service are required. Subscribers are saved in your WordPress database, and you can send them to the newsletter plugin you already use.

Four opt-in form types

• Popups: a lightbox popup centered, at the top or at the bottom of the screen, with an optional overlay.
• Fly-ins: a slide-in box in any corner of the screen that does not block reading.
• Inline forms: a signup form inside your posts and pages, added with the OptinFlare block or a shortcode, or inserted automatically in your content.
• Sticky bars: a floating bar at the top or bottom of the screen for announcements and newsletter signups.

A visual form builder

• Build each form with blocks: heading, text, image, icon, list, button, columns, divider, spacer, email and name fields, and a GDPR consent checkbox.
• Start from a ready-made template, then adapt the text, colors and layout to your brand.
• Set default fonts and colors once with global styles.
• Preview every form on desktop and mobile, and set a dedicated mobile width.
• Add an entrance animation: fade, slide or zoom.
• Write your own success and error messages.

Show your forms at the right moment

• Display triggers: immediately, after a time delay, after the visitor scrolls, on exit intent, or when a visitor clicks a button or link.
• Frequency control: show a form once per session or wait 3, 7, 14, 30 or 90 days before showing it again.
• Hide an inline form once the visitor has subscribed.

Collect and manage your leads

• Keep every submission in your WordPress database.
• Review subscribers in the dashboard and export them to CSV.
• Track impressions, submissions and the conversion rate of your forms.
• Control who can create forms or see submissions with WordPress roles.

Connect your newsletter plugin

Send new subscribers to MailerPress, MailPoet, FluentCRM, AcyMailing or The Newsletter Plugin when they are installed on your site. Local storage stays available when you do not use a newsletter plugin.

Spam protection and GDPR

• Block bots with Cloudflare Turnstile, Google reCAPTCHA or hCaptcha.
• Reject disposable or unwanted email domains with a domain blacklist.
• Collect separate marketing choices and retain the displayed notice. Diagnostic IP hashes are optional and off by default.

OptinFlare Pro

OptinFlare Pro is an optional companion plugin. It adds Mailchimp, Brevo, Kit, ActiveCampaign, MailerLite and SendGrid integrations, page targeting and display rules, visitor conditions, an inactivity trigger, two-step opt-ins, A/B testing, webhooks, coupon automation, AI features and premium templates. OptinFlare works fully without Pro.

External services

Depending on the configured features and actions, the following services may receive data:

• OptinFlare news and offers (optinflare.com): off by default. It runs only if the site owner turns on “Show OptinFlare news and offers” at the end of the setup wizard or later in the OptinFlare settings, and it stops as soon as the option is turned off. When it is on and a user with OptinFlare access opens an OptinFlare screen, the plugin loads product news and offers from https://optinflare.com/wp-json/optinflare-site/v1/promotions. The request sends the OptinFlare version, whether OptinFlare Pro is installed or active, whether a Pro license is activated, the number of days since installation, the user’s language and, only when one is configured, an access token. No site URL, domain, visitor or subscriber data is sent. Responses are cached for 30 minutes.
  OptinFlare terms: https://optinflare.com/terms-conditions/ ; privacy: https://optinflare.com/privacy-policy/

• CAPTCHA: Cloudflare Turnstile (challenges.cloudflare.com), Google reCAPTCHA (google.com) or hCaptcha (hcaptcha.com) validates submission tokens. The selected service receives the token, verification secret and, when provided, visitor IP; its browser widget also receives visitor/browser information. Without GDPR rules (the default), a configured CAPTCHA loads on the form unless a connected consent manager refuses it or waits for the visitor’s acceptance. GDPR profiles disable external CAPTCHA by default and load the widget only with visitor permission or an explicitly documented necessary security service. Sending the IP in server-side verification is a separate option, off by default. The local honeypot, signed token and rate limit remain available without the external widget.
  Cloudflare terms: https://www.cloudflare.com/website-terms/ ; privacy: https://www.cloudflare.com/privacypolicy/
  Google terms: https://policies.google.com/terms ; privacy: https://policies.google.com/privacy
  hCaptcha terms: https://www.hcaptcha.com/terms ; privacy: https://www.hcaptcha.com/privacy

AI features, newsletter services and webhooks provided by the Pro companion are documented in its readme. MailerPress, MailPoet, FluentCRM, AcyMailing and The Newsletter Plugin integrations use those installed plugins; their own service settings and privacy policies apply.

Privacy

OptinFlare provides configurable privacy controls; installing a plugin does not establish legal compliance. Review the applicable rules for your organization and audience, including clients outside the EU.

By default, GDPR rules are not applied: statistics, browser storage, display frequency, targeting and a configured CAPTCHA work without prior consent, and submissions are kept until you delete them. The site owner decides whether GDPR rules apply and can enable a GDPR profile under OptinFlare > Settings > Privacy. GDPR profiles require permission before optional browser storage, analytics and personalization; the “GDPR rules with documented exceptions” profile permits documented alternatives for applicable markets. Once a consent manager is connected, its answer takes precedence in every profile: a refusal, and also a visitor who has not accepted yet when the tool asks for consent first (for example Complianz or Cookiebot for the European Union). The visitor country is not used to determine applicable law. Cookiebot and Complianz can supply choices; other consent managers can use the optinflare:consent event. The plugin does not supply a consent banner.

When analytics is authorized under a GDPR profile, or when a consent manager supplies a choice without GDPR rules, a first-party HttpOnly, SameSite=Strict cookie (optinflare_privacy_receipt, Secure on HTTPS) allows this browser to withdraw authorization for delayed attribution. Its fixed lifetime is the shortest of 30 days, browser storage and local retention. It contains a random capability, never contact details. Server records contain digests, authorization state and creation/expiry dates. Verified exports include current state; erasure and restriction revoke linked records. Withdrawal is synchronized with the site, and retried after connection failures. A browser that is offline cannot notify the server until it reconnects. A new grant does not reactivate old evidence.

Submitted email, names, user-defined fields, the displayed privacy information, explicit choices and delivery results can be saved locally. Local saving can be disabled. Without GDPR rules, saved submissions and statistics are kept until you delete them, and unconfirmed requests remain valid for 90 days. Under a GDPR profile, submissions are deleted after the configured period (default 90 days), browser state expires after 30 days by default (maximum 180), unconfirmed requests expire after 30 days by default (maximum 90), and daily aggregate totals can remain for two years while detailed breakdowns follow local retention. Diagnostic IP hashes and user agents are off by default; referring URLs and automatic UTM enrichment are not stored in submissions. Cleanup uses WordPress scheduled tasks; configure a reliable system cron on low-traffic sites. Deactivation stops scheduled processing; backups and inactive installations need a separate deletion process.

WordPress Tools > Export Personal Data and Erase Personal Data include local OptinFlare submissions, evidence, notes and pending copies. Settings also support processing restrictions and correction of stored names. Erasure cancels local queued deliveries and records a keyed suppression marker to prevent stale jobs from restarting. A delivery already in progress or data already received by a provider cannot be recalled by this plugin. Address connected providers, mailboxes, server logs and backups separately.

Without GDPR rules, a form without a consent checkbox subscribes contacts, and a checkbox shown on the form is still respected. Under a GDPR profile, marketing and partner actions require their separate choice, an old policy acknowledgement is not evidence of marketing consent, and marketing retries require a fresh visitor request; review existing forms before enabling it. Double opt-in is recorded per destination; it is not a universal legal requirement or a substitute for meaningful consent. Publish your controller details, purposes, recipients, retention, rights contact and withdrawal process before collecting data.

Optional Google Analytics events use the site’s existing gtag integration only when analytics is permitted and the form enables them. Google receives event names and form identifiers/title/type, together with information its existing tag collects. OptinFlare does not install the Google tag or control its independent behavior. Google terms: https://marketingplatform.google.com/about/analytics/terms/us/ ; privacy: https://policies.google.com/privacy

Build source

The release includes its editable TypeScript/React/SCSS sources in assets/, its Gutenberg block sources in packages/gutenberg/, and the build configuration and locked dependency versions. The sources correspond to the bundled JavaScript and CSS. To rebuild in a development copy, install Node.js and pnpm, run pnpm install --frozen-lockfile, then pnpm run build. The webpack configuration uses tools/webpack-licenses.js to generate third-party notices. Do not install development dependencies on a production site.