Download websites that use Ninja Forms

About Ninja Forms

A form is the point where a website stops being a brochure. Somebody has decided to collect a name, an address, a file or a payment, which means there is a process behind the page and usually a person whose work depends on what arrives through it. Ninja Forms is one of the tools that decision produces on a WordPress site, and finding it says more about a business than most plugin detections do.

The plugin is written in PHP and built by Saturday Drive, which shipped the first release in 2011 and distributes the core under the GPL v2 license while selling paid extensions around it. The commercial model shapes what the data can and cannot show. Payment collection, CRM connections, file uploads and marketing integrations are add-ons, so a site running the plugin might be running a simple contact form or a multi step application handling money, and from the outside those look alike. We do not claim to tell them apart.

As of October 2026 we detect Ninja Forms on 47,035 sites, United States contributes 21,379 of that total, and .com carries most of the addresses. The shape is typical of the WordPress plugin economy, where a free core distributed through the official directory spreads far beyond the market the vendor actively sells into. A researcher should expect the population to mix serious commercial deployments with sites that installed a form builder once and never came back to it.

Version data turns a form plugin into a security question rather than a marketing one. We record 361 distinct version strings, with 3.15.5 recurring across a large share of installs. Forms accept untrusted input, sometimes including uploaded files, and they run inside a content management system with a long history of plugin vulnerabilities, so the spread of releases across a population is a meaningful risk map. Sites clustered on a current release are usually managed by somebody. Sites trailing well behind usually are not, and the difference between those two groups is often visible in nothing else on the page.

The gap between them is the reason to want the whole list rather than a single lookup. Agencies selling maintenance retainers, security vendors scoping exposure, and anyone building a WordPress product who needs to know which form builder a prospect already relies on are all asking a population question. A per-domain check answers for one site at a time and cannot be sorted, filtered by country or suffix, or compared between scans.

One limit applies throughout. Detection depends on plugin assets and markup staying recognisable in the delivered page, and caching, minification or an optimisation layer that concatenates scripts can hide the fingerprint completely, so the figures here are a floor rather than a full census.