Code

Discussion on Gravity Forms Encrypted Fields

Discussion on Gravity Forms Encrypted Fields

Cart 3,388 sales
Recently Updated

PluginOwl supports this item

Supported

This author's response time can be up to 5 business days.

692 comments found.

Hello,

we are using stripe payment plugin with our forms and recently there was an update from that plugin. With that update we noticed an error that is conflicting with our enfold plugin we are using here and that plugin that is causing customers recipes to not get sent out. I was wondering if there is a way to have this plugin updated to help resolve this issue?

Could you also kindly send us log in information to a dev site by clicking our user name and sending it via the author email contact form so we can review the environment? Do not list any credentials here

We are using Stripe’s credit card field. I will also work on getting you a log in for the dev site.

New in version 6.2.8
  • Fixed missing receipt field data sent to stripe when using the new stripe payment element in ver 6.0.

Dear Sir, dear Madam
When trying to view the submitted entries in gravity forms, I get an 502 error. We are using version 6.2.2 of the plugin on Siteground (hoster) and use async encryption to encrypt the PII data fields in our gravity form.
After opening a support ticket with siteground. I got the following reply:
Upon reviewing the situation, I’ve determined that the issue stems from a plugin you are using named “Gravity Forms Encrypted Fields.” This plugin appears to be adding extra headers to the submission page, causing the headers to accumulate and exceed the server’s limits, which results in a 502 error.

When the plugin is deactivated, the issue ceases, and the submission page loads correctly.

It’s important to note that this issue does not occur on the staging environment because our staging tool automatically strips some headers from the application, keeping them within acceptable limits. This is not the case in the production environmen

Hello

This sounds like your site may have a potential plugin conflict or just not enough memory to run the request. Encryption and decryption is generally more intensive than accessing static data and requesting too many actions at once can cause issues on servers with too little resources..

Initial things to try are

1. Decrease the # of entries loaded on the entries screen. 2. Increase available server memory 3. Please update to the latest version (6.2.5) and report if the problem persists along with WP version and php version.

Sadly the problem persists
Rebuild a copy of the site with only the necessary plugins
1. Decreasing the loaded entries works, however the export of the entries does not work. Need to split this up also to work.
2. Increased server memory to 512MB. This is limited because of the hosting provider
3. Updated the plugin to 6.2.5

WordPress Version is 6.8.3
PHP Version is 8.2.29
Used async encryption. Only one field is encrypted
Added 21 test entries, errors started when adding the 19th entry

Hello

It sounds like there may be a different issue at work here. Do you have a dev site that we can log in and take a look at to see what the conflict might be? If so please send the credentials by clicking on our user name and using the author email contact form. Do not list them here.

Hello. I recently purchased the PluginOwl plugin and my IT team has a list of security questions I’m wondering if you can help with:

Cryptography & Data Flow • Algorithms & modes: What exact cipher and mode are used (e.g., AES-256-GCM vs AES-256-CBC + MAC)? • IV/nonce: Do you generate a unique, random IV/nonce per record, and how is it stored? • Integrity: Do you use authenticated encryption (AEAD) so tampering is detectable? • Scope: Which Gravity Forms data types are encrypted (fields, meta, notes)? Are file uploads also encrypted? Key Management • Key storage & protection: Where are keys created and stored (DB, wp-config.php, file system, external KMS)? How are they protected in backups? • Rotation: Do you support key rotation and re-encryption of existing entries? Access Control & Audit • RBAC: Which roles/capabilities control decryption visibility, and is it configurable per field/form? • Audit logging: Do you log who decrypts/views sensitive fields, and can those logs be exported for compliance? • Exports & notifications: Are encrypted fields exported or emailed as ciphertext unless explicitly decrypted by an authorized user?

We don’t need proprietary internals, just enough to satisfy our compliance protocols.

Thank you so much in advance!

Sara Goese sara.goese@sfmic.com

Hello

Most of the answers to your questions are dependent on how you configure the plugin. And others are answered in the plugin description and setup instructions.

Different encryption modes can be chosen.

Rand IV per data record

The keys are not actually hard stored anywhere.

Roles and users that can access are chosen and is per individual field.

You can decrypt in batch and re-encrypt with new keys in batch.

What is available as decrypted in admin , emails, and exports is chosen , and also controlled by users/role access for admin access and exports.

AEAD is not used as this is designed for encryption at rest and not in transit although it has features to assist with transit solutions etc. in transit, SSL/TLS should cover this and at rest, entire DB layer encryption would be the place to apply this generally speaking were it necessary.

The plug-in does not have an access /audit log for admin functions. Other admin focused plugins can track admin access trails for this purpose. Limited user/role access greatly reduces this need alongside general WP or gravity forms logging if desired in box.

Once you have followed the setup instructions, much should be apparent.

Hope this helps :)

Onsharp Purchased

Hello, How can I set the form up to send the selected field values encrypted when submitting a form? When I look in the browser developer console, the data is sent as plain text. Shouldn’t it be sent as encrypted data? Thanks, Mike

Hello

Use SSL.

SSL serves the purpose of providing implicit encryption between the clients browser and the server on submission, so all the web forms you fill out online use this to protect that “plain text” data in transit. It is plain text to your browser because the originating browser because that always has direct access to what is being input into it.

To encrypt data in the clients browser before even sending it would be double encrypted over SSL.

Hope this helps :)

Onsharp Purchased

Yes, that makes sense. Thank you for the quick response!

Hello,

I have found that the encryption plugin does not work completely with Gravity Forms Survey Add-on (https://www.gravityforms.com/add-ons/survey/). In the email notification, I am using {gfef_decrypt_ALL+} but all of the survey specific fields display an invalid value.

Example:

What is your gender? – gsurvey110cbf22b2

Screenshot of email – https://tinyurl.com/24cj9a5s

The data displays correctly on the website backend, its only the email that has an issue.

Hello

Did you unlock the decrypted merge tags for use ( on the plug-in settings page)?

Yes. If you look at the values they are not displaying encrypted, they are displaying as “gsurvey110cbf22b2” or similar which I assume is a field ID that is replaced by the Gravity Fields Survey add-on.

As noted in my original comment, these values display correctly when viewing the entry on the backend, its only in the email that they show up as “gsurvey110cbf22b2”.

Hello

Please install the latest plugin update ver 6.2.5 which should address the output of the survey fields in the ALL+ decrypted merge tags.

New in version 6.2.5
  • Added support for survey fields in “ALL+” type decrypted merge tags eg: {gfef_decrypt_ALL+}
  • Updated encrypted and hidden field form editor indicator icon CSS for better positioning
  • Tested on WP 6.8.2

Hope this helps :)

Following up on the previous comment, I’ve purchased the plugin and configured it. I can confirm that it encrypts the data in the database, and my unmodified REST API script is able to retrieve the data unencrypted without any changes. I’m not sure if this was an intended feature, but it works perfectly for my case!

Also, if I were to use this for multiple sites, would I need to purchase them individually for the licenses?

Hello Yes if you use a user with data access permissions via the API the data is decrypted for you transparently, the same as accessing through the GF interface. However there are lots of uses and 2 versions via the API so regardless of how it’s used it can be accomplished like this or using the developer functions to drop in.

Each site does require its own license per the Envato licensing agreement.

Hope this helps :)

Hi,

I have a quick question regarding how this plugin might affect the REST API functionality for Gravity Forms.

Currently, I have a WordPress multisite setup, with sign-up forms on each site. I’m running a script that uses the Gravity Forms REST API to export all form entries to an external database. After the export, the entries are deleted from WordPress.

If we use this plugin to encrypt form data, will it impact our ability to export entries via the API? Additionally, is there a way to decrypt the data externally so we can decrypt the exported entries before importing them into our external database?

Thanks in advance for your help.

Best, Julian

Hello

The plug-in has developer decryption functions so you can just drop one in to decrypt the data within your API code before sending it securely (encrypted) over SSL. Same way the user enters it and sends it to you.

Or If you need explicit encryption in transit you can build a decryption method on the receiving end after you generate and grab the decryption key with some code. It’s not actually stored anywhere. This is custom coding of course and not something we directly support but users have done it this way if needing explicit encryption on top of the ssl implicit encryption in transit

josh803

josh803 Purchased

Question: I can access the decrypted merge tags as described, but the plugin appears to disable the merge tag selector from the individual fields under Settings > Webhooks > Request Body > Field Valued > Value (select “Add Custom Value” and merge tag icon appears in top right corner of the field but on click it usually opens up the available tags, in this case it’s just grayed out).

josh803

josh803 Purchased

According to the plugin docs it’s a bug since it says “Once merge tags are unlocked here they will become available in the Gravity Forms merge tag dropdown selectors.”

Hello

We will follow up after checking into the webhooks add on regarding the merge tags. Our plug-in does not disable anything by direct extension, but adds decrypted merge tags using gravity forms own documented filters, so there may be an external factor or a conflict in play. Again, we will pass this to the plug-in devs for testing and follow up

Hi,

I’m not sure if this belongs in support or not, but could be helpful to others so I’ll ask here.

With installing an update to this plugin in WordPress, will it cause any interruption or other adjustments to get everything working as it was pre-update?

Kind regards

John

Hello

There should be no interruptions or adjustments needed. If you are using the auto website key as directed, just install the update and continue as usual.

If for some reason you are using a custom website key the easiest method to use is to just copy it before updating and check it immediately after to be sure it passed through. If it did not, just paste in the correct previous custom one and save it again.

exids

exids Purchased

We originally bough a license for the GF Encrypted Forms plugin and had it used on an old site – that site has since expired and is no longer active, so we are trying to use the plugin now on a different site but cannot seem to deactivate the original sites for that license. can you please help us refresh our license so we can use it on our new site

Hello

Please click on our user name and send a message including your purchase code using the author contact form and we can clear the licensing for you. DO NOT LIST YOUR PURCHASE CODE HERE PUBLICLY.

Hi,

I’ve searched the support threads here for my question, but it’s quite hard to see if it’s been asked / responded-to due to similar keywords.

My question: it appears the standard Gravity Forms Field type “Hidden Field” is not supported by this plugin.

I’d like to know if it is possible to support encryption/decryption for this field, as we use them extensively for identifiers (like gclid, etc.), that we’d like to have encrypted at rest.

Can you let us know if supporting this field is possible:

1) Currently with the plugin (ie: we're just missing something)
2) Via filters, additional php code, etc.
3) In a potential plugin update.

Hello

The hidden field type is essentially a single line text field with its visibility options set to “hidden” and far less flexibility. Because of this, it is recommended to use the single line text field and just set its visibility to hidden whenever possible so that the field has the most flexible usage currently and in the future.

However, per your point we have added the “hidden” field type to the supported field types for all encryption options.

Please download the latest plugin version to make use of the new functionality.

VER 6.2.4 * Added “hidden” field type to supported fields for encryption and hide field options * Plugin licensing response text improved. * Tested on WP 6.8.2

Hope this helps :)

Thank you! That is a very impressive level of support. We’re very glad we chose your plugin for our sites!!!

Hello,

We are enjoying using this plugin for our gravity forms. Recently the plugin Gravity PDF updated to version v6.13 and with that they have changed the outdate .php code on their pdf directory that is Causing a 404 error with our custom PDF template from you as explained in Gravity pdf documentation here: https://docs.gravitypdf.com/v6/users/404-template-css . From what we can see from their sample template is that there is a lot of excess code that was no longer needed that they removed as shown here: https://gist.github.com/jakejackson1/d98b99fd504a5a300f1a. We are not sure if templates are used at all but based on the template you gave us here: https://gf.wels.net/wp-content/uploads/2025/07/2025-07-30_15-25-17.png. We are checking to see if we are the ones responsible to change the .php code to match and if so is their anything that would need to not be changed? or would you be able to change the .php code so that the updated plugin does not continue to give us a 404 error. Another Question is the prevent direct access to the template forms are different from yours to the sample one and if we should keep it as is or if it is ok to change.

Thank you, Cassandra Greenwald

Hello

The template provided is just an example of how to use our merge tags within a custom template. If the directory has changed you should be able to just move the template to the correct new directory as directed by gravity.pdf

However we have not experienced any 404 errors after upgrading. We will look into it and update the instructions for the template as necessary, but overall you can use and modify the template however is desired or as directed by gravity pdf

Hello

You may want to try reinstalling the template. You can zip it first if needed before upload when adding a new template via the gravity pdf template manager interface. This should install to the correct directory and is confirmed working.

Hi,

I hope this message finds you well. We like to get some support, after we we push the development version of the website to live we are now getting this message when I tried to access the settings even though the he License Registration filed contains the correct license.:

This Purchase Code has already been activated on the following 2 websites : https://rareportal.org.au https://dev.rareportal.cxitservices.com.au You must purchase an additional license or deregister a license from within one of the registered websites. Settings->GF Encrypted Fields-Licensing is near top of page.

What we’ve done before this happened are: 1. cloned the live website to a dev website. 2. worked on the redesign/changes from the dev website. 3. replaced the live website with dev version (which is now live)

I cannot access the settings because it’s prompting about the license. At the moment only “Admin’ uses can view encrypted fields, but we have some user roles that we set to view the fields too.

We hope you can help us with this.

Kind regards, Anne

I just sent an email with the Purchase code. Thank you.

License activations have been cleared

Thank you! I’m able to access the settings now.

bgebben

bgebben Purchased

Issues with notifications:

HTML table formatting: When using {gfef_decrypt_ALL+}, notifications show HTML table markup instead of plain text

Empty fields displaying: I was able to get plain text by using individual field tags matching the field ids like {gfef_decrypt_2}, but now all fields show in notifications even when empty due to conditional logic.

What we need: A way to get plain text notifications that only show fields with actual data (no empty field labels).

Is there a merge tag like {gfef_decrypt_ALL_FILLED} that shows only populated fields in plain text format?

Hello

The {gfef_decrypt_ALL+} merge tag mimics the standard table output of the “all fields” merge tag, but decrypts the encrypted fields.

If you want to customize your notification. You can use single decrypted field merge tags anywhere you would like in your custom confirmation/notification the same as you would with the standard merge tags to customize your confirmation/notification outside of the standard “all fields” tag.

To show labels only if the field has data you can use the standard gravity forms conditional shortcodes to display the field label, only if the field has data.

https://docs.gravityforms.com/conditional-shortcode/

Hi,

We purchased this plugin a couple of weeks ago as part of a project that involves us obtaining any unread entries from GF via their API (V2) then marking them as read once we have imported the data in another system.

The former, obtaining unread entry data is working as expected with the encryption plugin enabled on the form in question, however though upon using a PUT request to simply mark a specific entry as read it purge the entire entry of form data.

The behavior mentioned I haven’t seen until I’ve installed your plugin, can you offer some advice please?

For the sake of data protection we could immediately delete processed entries, but we chose to use your plugin so that we have an audit trial for troubleshooting before the entries are deleted after a short retention period.

Kind regards

hello

Our support for the issue has to come with an up front soft notice that we do not officially support custom developments using the plugin.

That said:

Are you resaving the entire entry with the push request , or just updating the entry property? It is safer/easier to just update the entry property rather than resave the entire entry. This should not ever result in any other change to the entry as nothing else is affected and our plug-in does not affect this.

If you resave the entire entry you have to be sure it’s done correctly when using encryption etc , so this would be a possible issue.

1. Check to see if the entry data is actually gone or if it is just appearing “missing” due to incorrect encryption key for decryption etc. Assuming it is a development site or is not live, You can use the encryption verification mode from the plugin settings page to check the raw data from the db for the entry in question, or you can check your actual db for the data.

2. If you are updating the entry , try to change to updating only the entry property instead, and try to use or pull the original entry object again and not use the entry object you have already pulled and processed/decrypted to pass to the new system etc. as you could have processed that it ways to not be suitable for saving over the DB entry data.

Thanks for your response,

What I’ve been doing so far is sending a PUT request to GF with just the is_read property set to 1 (according to GF API V2 docs this is how you update an entry), what I hadn’t realised was that the response JSON was the whole entry not just the is_read property.

I’ve raised this with GF and they’ve said they don’t support updating just one or several properties but you have to resubmit the whole JSON object for that entry.

Given your comments on re-saving the entire entry ‘properly’ can you provide any specific guidance? my intent is to send the entire entry JSON back 1:1 with how it’s received with only the is_read property changed to 1.

Kind regards

John

Hello

1. Did you verify that the entry (or its data) is actually deleted, and not just unreadable as encrypted per the above guidance?

2. Are you using a curl request to put? I would start by talking a look at the put request and making sure it includes the entire entry with all its entry properties and field data, and not just the single entry property to update. The update functionality requires all entry properties and field data to be included in the request or it removes anything not included from the resulting updated entry.

If you are pulling the entry sans field labels and anything else that would cause the format of the object to not comply with the Later Put request, you can try saving the retrieved entry to a separate variable and then only updating the property and using it to send the subsequent push request.

3. For testing basic functionality of using the api with encryption, you can try CREATING some simple entries via API for the form that include one or two of the encrypted fields data in the request and viewing the resulting created entries.

Hi,

Thanks for your previous response relating to access and obtaining data via the GF API.

We’ve just purchased this plug-in, we’re intending to install it onto a test site before moving it over to our live site, will there be any issues regarding licensing? it will only be active on one site at a time.

Kind regards

John

Hello Licensing should not be an issue

Users are able to view the entry and encrypted data is properly decrypted for display.

However, when you click “Print Entry” the resulting output includes “Encrypted Field Restricted” on encrypted fields. How can decrypted data be added/displayed on printed output?

Hello

Kindly check your demo site for results now. The option “admin area only viewing” was selected by default in the settings page for the Encrypted Fields plugin, and the print preview page is not an WP administrative page ..so it was being restricted for viewing of encrypted field data. While front end viewing is allowed, all other view permissions still apply so as “admin” was now added to the user/role permission list, admins can now view the data when and where it is displayed in the front end via the GFAPI such as in in the print preview page.

Hope this helps :)

Thank you! I guess we misunderstood the use of the “admin area” and how the Gravity Form print screen is not considered an admin screen. We see it working and have applied the changes to our production site. Thank you!

Hello

Glad you have it working now. The GF entry print screen is rendered outside of WP admin by GF and WP so it falls under the exclusion.

Hi, I recently purchased this am enjoying the plugin! But is there a way to also encrypt files that are uploaded? This would help a lot, thanks so much.

Our plug-in does not currently encrypt files. You can already store files encrypted with great access control by using the Google drive or Dropbox add on modules from gravity forms. Both of those systems have completely passive encryption for all storage and great access control and sharing built in.

Hi I’m considering this plugin as part of a solution for securing sensitive data that would be stored in an entry from the Gravity Forms plugin.

The project I’m working on will require us to request the entry content via the Gravity Forms V2 API. my questions here are:

1. Will we be able to (via whatever means) have specific user(s) view the decrypted entry info via the WP Admin user interface? (Reasoning for this is as part of an audit trail should there be any issues with the process as a whole, including user error/input)

2. More importantly, will the entry data returned by a GET request remain encrypted or in plain text? The latter is what I’m hoping being that the CRM we use doesn’t have the inbuilt capability of decryption and building something in it’s proprietary language would be extremely time consuming if technically possible at all.

Kind regards

John

Hello

1. Yes

2. If you are using the GFAPI web access it can require user authentication, and you should use SSL for the connection. the data is then sent encrypted in transit by means of SSL in that case but Is not explicitly additionally encrypted by our plug-in requiring decryption on the other end of the SSL connection. This is the same data encryption in transit as when the user first enters it in their browser and it is transmitted to your server over SSL. If you desired you could send the data encrypted requiring explicit decryption that you build out, but otherwise having SSL handle the implicit encryption in transit is the default and would require no additional coding on the receiving end.

Hope this helps :)

Thanks for the quick response, it’s very much appreciated!

1. Great, that’s very useful.

2. Excellent, I’ve already put together a REST API integration on another site for another project using basic https authentication and that does everything it needs to. On this project this will effectively be no different from the CRM setup side of things which is a relief.

Thanks again for your help, no doubt we’ll be purchasing this once I get sign off.

Kind regards

John

Hi, can check can i encrypt the fields after notification is sent out? Currently the fields is encrypted in email.

Hello

Please follow setup instructions section for sending decrypted notification emails. Using setup configuration You can use the decrypted merge tags in them. There is full instruction on this during plugin setup and video to follow.

Hope this helps :)

by
by
by
by
by
by

Tell us what you think!

We'd like to ask you a few questions to help improve CodeCanyon.

Sure, take me to the survey