Managing entries

How forms are protected

What the plugin checks on the server, how files, links, integrations and staff permissions are protected, and what you should still do on your site.

Everything a visitor sends is checked again on the server, whatever the page or the browser did. This page describes those checks so you can judge them; it is not a certification, and the security of your site also depends on WordPress, your theme, other plugins and your host.

Every submission

• A signed form token. Each form page carries a token signed with your site's secret keys. It names the form, the page address and when the page was made. The server refuses submissions without a valid token, and asks a page that was open for a very long time to send again with a fresh one. Details such as the page address come from the token, never from the browser.
• The form's own rules again. Required fields, lengths, patterns, choices, dates, limits, uploads and calculations are checked on the server with the published version of the form. Answers to fields that were hidden by conditions or not meant for this visitor are ignored. Totals and payment amounts are always recalculated on the server.
• Fixed values stay fixed. Read only fields keep their default, values from the page address never set prices or roles, and signed link values are refused when changed (see Embedding forms).
• Spam and abuse limits. See Spam protection for the honeypot, timing, rate limits and challenges.
• Clean answers. Plain text answers lose HTML tags; rich text keeps only safe formatting. Answers are escaped wherever they are shown: in the dashboard, emails, exports and confirmations. Spreadsheet exports guard against formulas (see Entries).

Files

Uploads are checked by extension and by content, scripts are never accepted, and files are stored under random names in a private folder that is tested for direct access. Where the server would expose that folder, files are stored encrypted. Files open through signed links for people allowed to see the entry, and links in emails expire (after 7 days by default). See File uploads.

Links

Links that fill in answers, show an entry or open a file are signed, and changing anything in them makes them invalid. Links to an entry and file links in emails expire, and pages opened with a link to an entry are marked so caches and search engines do not keep them.

Integrations and webhooks

Requests to outside services only go to public addresses: addresses on your own network are refused unless you list them, redirects are limited and checked again, and replies are size limited. Webhooks can sign their requests so the receiver can check them. Account keys are stored encrypted and are never shown again after saving.

Staff

Every dashboard action checks a capability (manage forms, view, edit, delete or export entries, import, settings, integrations), and each form can limit its entries to chosen roles. Only administrators who may post unfiltered HTML can add raw HTML or custom JavaScript, and the JavaScript runs only after an administrator allows it in Settings. Important actions are recorded in the entry timeline and the plugin's log.

What you should still do

• Keep WordPress, your theme and plugins up to date, and use strong passwords with two step sign in for staff.
• Set FLVF_ENCRYPTION_KEY in wp-config.php if you encrypt answers, so a copy of the database alone cannot read them, and keep a copy of the key somewhere safe.
• If Diagnostics says the private folder can be reached from the web, ask your host to block it, or set FLVF_PRIVATE_DIR to a folder outside the web root.
• Collect only what you need and set how long entries are kept (see Privacy and data).