Create new posts
with a front-end form

What this example does

• Displays a field group created in the CFS settings on the front end.
• Allows a signed-in user to create a draft in a specified post type.
• Supports tabs, accordions, conditional groups, and loop fields in the same form.

Prepare a field group

1. Open Settings → atshift Fields and create a field group.
2. Add the fields you need and configure required fields and row limits.
3. Open the field group editor and find its numeric ID in the post=123 part of the URL.

Replace 123 in the examples below with the ID of your field group.

Reject signed-out submissions

Add this to the theme's functions.php or a site-specific plugin. New posts use the post type's create_posts capability.

<?php
add_filter(
  'cfs_form_can_save',
  function ( $can_save, $post_id, $post_data ) {
    if ( ! is_user_logged_in() ) {
      return false;
    }

    $post_type = sanitize_key( $post_data['post_type'] ?? 'post' );
    $object    = get_post_type_object( $post_type );

    return $object
      && current_user_can( $object->cap->create_posts );
  },
  10,
  5
);

Load the form CSS and JavaScript

This example uses a page with the slug front-form. Register the form assets on wp_enqueue_scripts so they are available before wp_head() runs.

<?php
add_action( 'wp_enqueue_scripts', function () {
  if ( is_page( 'front-form' ) && is_user_logged_in() ) {
    CFS()->form->load_assets();
  }
} );

Render the form in a page template

This page template creates a new draft in the member_entry custom post type.

<?php
/* Template Name: CFS Front-end Form */

if ( ! is_user_logged_in() ) {
  auth_redirect();
}

$post_type = 'member_entry'; // Custom post type used as the destination.

get_header();
?>

<main class="front-form">
  <h1>Create entry</h1>

  <?php
  echo CFS()->form( array(
    'post_id'              => false, // false creates a new post.
    'field_groups'         => array( 123 ), // Field group ID.
    'post_type'            => $post_type, // Destination post type.
    'post_status'          => 'draft', // Save new posts as drafts.
    'post_title'           => 'Title',
    'submit_label'         => 'Save',
    'confirmation_url'     => home_url( '/front-form/?saved=1' ),
  ) );
  ?>
</main>

<?php get_footer(); ?>

Safeguards for public forms

A form intentionally available to signed-out visitors needs additional controls.

• Fix the destination: Define the post type, post status, and field group IDs on the server.
• Limit submissions: Apply IP or session rate limits and consider CAPTCHA and WAF controls.
• Limit payload size: Restrict text length, array size, loop rows, and total request size.
• Validate by field type: Validate email, URL, and numeric values, and allow only necessary HTML.
• Validate referenced IDs: Confirm that related posts, users, terms, and attachments are selectable.
• Restrict files: Limit MIME types, extensions, file size, and upload capabilities.
• Escape output: Use functions such as esc_html(), esc_url(), and wp_kses_post() for the output context.

Test before deployment

• A signed-out visitor is redirected to the login screen.
• Only users with the required capability can create new posts.
• Tabs, conditional groups, and loop fields render and save correctly.
• The saved post type and post status match the intended configuration.
• Saved values are escaped correctly wherever they are displayed.