{"id":381837,"date":"2026-10-11T18:30:48","date_gmt":"2026-10-11T18:30:48","guid":{"rendered":"https:\/\/wordpress.org\/plugins\/form-marshal\/"},"modified":"2026-10-12T19:11:10","modified_gmt":"2026-10-12T19:11:10","slug":"form-marshal","status":"publish","type":"plugin","link":"https:\/\/wordpress.org\/plugins\/form-marshal\/","author":9039316,"comment_status":"closed","ping_status":"closed","template":"","meta":{"version":"0.6.3","stable_tag":"0.6.3","tested":"7.1.3","requires":"6.4","requires_php":"7.4","requires_plugins":null,"header_name":"Form Marshal","header_author":"Brent Passmore","header_description":"Scans Gravity Forms, Ninja Forms, WPForms, Contact Form 7, Fluent Forms, and Forminator forms for PHI and PII, reports findings, and blocks forms that should not collect them, with a time-limited exception path.","assets_banners_color":"506784","last_updated":"2026-10-12 19:11:10","external_support_url":"","external_repository_url":"","donate_link":"","header_plugin_uri":"https:\/\/github.com\/bpmore\/form-marshal-support","header_author_uri":"","rating":0,"author_block_rating":0,"active_installs":0,"downloads":71,"num_ratings":0,"support_threads":0,"support_threads_resolved":0,"author_block_count":0,"sections":["description","installation","faq","changelog"],"tags":{"0.6.2":{"tag":"0.6.2","author":"bpmore","date":"2026-10-11 18:30:32","revision":3739946},"0.6.3":{"tag":"0.6.3","author":"bpmore","date":"2026-10-12 19:11:10","revision":3742368}},"upgrade_notice":{"0.6.2":"

The policy alert now always has a button to hide it. A form_marshal\/block_markup<\/code> filter can no longer add scripts or event attributes.<\/p>","0.6.1":"

No change in how forms are scanned or blocked.<\/p>","0.6.0":"

Adds Fluent Forms and Forminator. On a site that uses them, their forms appear in the report on the next scan, and Block mode applies to them: set Flag mode first on a copy of a live site.<\/p>","0.5.0":"

The network dashboard, digest, webhook, monitoring endpoint, and audit export are now in Form Marshal Pro. Install Pro to keep them; your settings carry over.<\/p>"},"ratings":[],"assets_icons":{"icon-128x128.png":{"filename":"icon-128x128.png","revision":3739946,"resolution":"128x128","location":"assets","locale":"","width":128,"height":128},"icon-256x256.png":{"filename":"icon-256x256.png","revision":3739946,"resolution":"256x256","location":"assets","locale":"","width":256,"height":256},"icon.svg":{"filename":"icon.svg","revision":3739946,"resolution":false,"location":"assets","locale":false}},"assets_banners":{"banner-1544x500.png":{"filename":"banner-1544x500.png","revision":3739946,"resolution":"1544x500","location":"assets","locale":"","width":1544,"height":500},"banner-772x250.png":{"filename":"banner-772x250.png","revision":3739946,"resolution":"772x250","location":"assets","locale":"","width":772,"height":250}},"assets_blueprints":{},"all_blocks":[],"tagged_versions":["0.6.2","0.6.3"],"block_files":[],"assets_screenshots":{"screenshot-1.png":{"filename":"screenshot-1.png","revision":3739946,"resolution":"1","location":"assets","locale":"","width":1280,"height":1000},"screenshot-2.png":{"filename":"screenshot-2.png","revision":3739946,"resolution":"2","location":"assets","locale":"","width":1280,"height":1000},"screenshot-3.png":{"filename":"screenshot-3.png","revision":3739946,"resolution":"3","location":"assets","locale":"","width":1280,"height":1000},"screenshot-4.png":{"filename":"screenshot-4.png","revision":3739946,"resolution":"4","location":"assets","locale":"","width":1280,"height":860},"screenshot-5.png":{"filename":"screenshot-5.png","revision":3739946,"resolution":"5","location":"assets","locale":"","width":1280,"height":1000}},"screenshots":{"1":"The report: every form with its status, evidence, entries, and where its data goes.","2":"A form's page: findings by field, in plain sentences.","3":"Live warnings in the form editor.","4":"What a visitor sees in place of a blocked form.","5":"Settings, with values locked by an organization's policy pack."}},"plugin_section":[262246],"plugin_tags":[14361,601,1655,38099,396],"plugin_category":[42,54],"plugin_contributors":[285885],"plugin_business_model":[],"class_list":["post-381837","plugin","type-plugin","status-publish","hentry","plugin_section-dashboard-widgets","plugin_tags-compliance","plugin_tags-forms","plugin_tags-gravity-forms","plugin_tags-hipaa","plugin_tags-privacy","plugin_category-contact-forms","plugin_category-security-and-spam-protection","plugin_contributors-bpmore","plugin_committers-bpmore"],"banners":{"banner":"https:\/\/ps.w.org\/form-marshal\/assets\/banner-772x250.png?rev=3739946","banner_2x":"https:\/\/ps.w.org\/form-marshal\/assets\/banner-1544x500.png?rev=3739946","banner_rtl":false,"banner_2x_rtl":false},"icons":{"svg":"https:\/\/ps.w.org\/form-marshal\/assets\/icon.svg?rev=3739946","icon":"https:\/\/ps.w.org\/form-marshal\/assets\/icon.svg?rev=3739946","icon_2x":false,"generated":false},"screenshots":[{"src":"https:\/\/ps.w.org\/form-marshal\/assets\/screenshot-1.png?rev=3739946","caption":"The report: every form with its status, evidence, entries, and where its data goes."},{"src":"https:\/\/ps.w.org\/form-marshal\/assets\/screenshot-2.png?rev=3739946","caption":"A form's page: findings by field, in plain sentences."},{"src":"https:\/\/ps.w.org\/form-marshal\/assets\/screenshot-3.png?rev=3739946","caption":"Live warnings in the form editor."},{"src":"https:\/\/ps.w.org\/form-marshal\/assets\/screenshot-4.png?rev=3739946","caption":"What a visitor sees in place of a blocked form."},{"src":"https:\/\/ps.w.org\/form-marshal\/assets\/screenshot-5.png?rev=3739946","caption":"Settings, with values locked by an organization's policy pack."}],"raw_content":"\n

Website forms are easy to build and easy to get wrong. A form that asks for a diagnosis, a date of birth next to a name, or answers to a depression screening questionnaire turns a website into a place that stores health information. Most form plugins store every answer in the WordPress database, unencrypted, and none of them signs a business associate agreement.<\/p>\n\n

Form Marshal checks every form on the site and tells you which ones collect protected health information (PHI) or personally identifiable information (PII), field by field, in plain sentences. In Block mode it turns off the forms that should not be running, on every page they appear on, and refuses their submissions, with a time-limited exception process for the cases that need one.<\/p>\n\n

Form Marshal is a control, not a compliance guarantee.<\/strong> It flags likely problems and gives administrators tools to act. It does not certify that a site meets HIPAA or any other rule.<\/p>\n\n

Works with<\/h4>\n\n
    \n
  • Gravity Forms<\/li>\n
  • Ninja Forms<\/li>\n
  • WPForms<\/li>\n
  • Contact Form 7<\/li>\n
  • Fluent Forms (and Fluent Forms Pro)<\/li>\n
  • Forminator<\/li>\n<\/ul>\n\n

    Finds<\/h4>\n\n
      \n
    • Every form, every field<\/strong>: field types, labels, descriptions, placeholders, choices, hidden fields, the pages each form is placed on, and where answers go (emails, add-ons, redirects).<\/li>\n
    • Four classes<\/strong>: clear, PII, PHI, and PHI (screening instrument), with a severity. Screening questionnaires such as PHQ-9 and GAD-7 count as PHI even without a name field, because form plugins record the time and often the IP address with every answer.<\/li>\n
    • Stored answers, safely<\/strong>: optional sampling of up to 100 stored entries per flagged form, checked for patterns such as Social Security numbers, dates of birth, and health words. Only the pattern name and a count are kept, never the answer.<\/li>\n<\/ul>\n\n

      Blocks<\/h4>\n\n
        \n
      • Block mode<\/strong> replaces a flagged form wherever it appears with a short message and refuses its submissions before anything is stored, emailed, or sent on. Flag mode only reports.<\/li>\n
      • Exceptions<\/strong>: an editor asks for one with a reason; an administrator approves it for a limited time, with an optional retention limit for stored entries. Exceptions end on their own.<\/li>\n
      • Editor warnings<\/strong> (all six form plugins): while a form is being built, a status box and notes under each field say what was found.<\/li>\n<\/ul>\n\n

        Reports and acts<\/h4>\n\n
          \n
        • A report of every form with its status, evidence, entries, where data goes, and the pages it appears on.<\/li>\n
        • A page per form with findings by field, in plain sentences.<\/li>\n
        • Stored entries: set a retention period, export to CSV and delete only exported entries, or mark as reviewed. New entries and drafts stay after export. Every action asks for confirmation and is recorded in an audit log.<\/li>\n
        • An admin notice with your organization's policy, with optional acknowledgment.<\/li>\n
        • Email notices when a form becomes PHI or is blocked, and for exception requests.<\/li>\n
        • WP-CLI commands for scanning, reporting, exceptions, and entries.<\/li>\n
        • A policy filter (form_marshal\/policy<\/code>) so an organization can ship its own settings and lock them.<\/li>\n<\/ul>\n\n

          Form Marshal Pro<\/h4>\n\n

          A separate paid add-on for organizations with many sites or auditors to answer: a compliance report to print, save as PDF, or download as Markdown, a network dashboard and minimums for multisite, a daily digest email, a signed webhook, a monitoring endpoint, and audit log export. Form Marshal itself is complete without it.<\/p>\n\n

          Privacy<\/h4>\n\n
            \n
          • Form Marshal never stores, logs, emails, or displays a form answer. Findings hold field IDs, tags, and counts. A test checks that a seeded Social Security number appears nowhere after a scan.<\/li>\n
          • It makes no requests to outside services and sends no usage data.<\/li>\n
          • It deletes nothing on its own: retention changes, exports, and purges are administrator actions with a confirmation. Exports stream to the browser and are never written to the server.<\/li>\n<\/ul>\n\n\n
              \n
            1. Install a supported form plugin: Gravity Forms 2.7 or newer, Ninja Forms, WPForms, Contact Form 7, Fluent Forms, or Forminator.<\/li>\n
            2. Install and activate Form Marshal.<\/li>\n
            3. On a copy of a live site, go to the settings and set enforcement to Flag<\/strong> first, so nothing is blocked while you review the results. The default is Block<\/strong>.<\/li>\n
            4. Open Forms > Form Marshal<\/strong> (or Tools > Form Marshal<\/strong> if Gravity Forms is not installed) and review the report.<\/li>\n<\/ol>\n\n

              On multisite, network-activate to cover every site.<\/p>\n\n\n

              \n

              Does Form Marshal make my site HIPAA compliant?<\/h3><\/dt>\n

              No. It is a control that finds and stops forms that are likely to collect health information. Compliance depends on your whole organization, your agreements, and your hosting.<\/p><\/dd>\n

              Will it turn off my forms?<\/h3><\/dt>\n

              In Block mode (the default), yes, for forms it classifies as PHI. Use Flag mode to see the results first. Personal-information forms are reported but not blocked unless you choose to.<\/p><\/dd>\n

              Does it read the answers people submitted?<\/h3><\/dt>\n

              Only if entry sampling is on, and only to look for patterns. It keeps the pattern name and a count, never the answer, and never stores, logs, or sends answers anywhere.<\/p><\/dd>\n

              Does it send data anywhere?<\/h3><\/dt>\n

              No. Form Marshal makes no outside requests.<\/p><\/dd>\n

              What happens to a blocked form's page?<\/h3><\/dt>\n

              Visitors see a short message in place of the form. You can change the message, and an organization's policy pack can add a contact.<\/p><\/dd>\n\n<\/dl>\n\n\n

              0.6.3<\/h4>\n\n
                \n
              • Export and purge now deletes only the entries included in a completed CSV. New entries and drafts are kept.<\/li>\n

              • Failed or incomplete exports delete nothing. Purge without export still removes all entries and drafts after confirmation.<\/p><\/li>\n

              • Failed findings saves keep the last complete blocking decision and evidence.<\/p><\/li>\n

              • Network activation stays within its network. Network deactivation clears plugin schedules across that network while keeping data.<\/li>\n<\/ul>\n\n

                0.6.2<\/h4>\n\n
                  \n
                • The policy alert can always be hidden by each user: \"I have read this\" when acknowledgment is required, \"Dismiss\" otherwise. It returns when the message changes.<\/li>\n
                • Security hardening: the message shown in place of a blocked form is escaped again after the form_marshal\/block_markup<\/code> filter, status badges are escaped where they are printed, and the report's Filter button checks a nonce and the user's permission.<\/li>\n<\/ul>\n\n

                  0.6.1<\/h4>\n\n
                    \n
                  • Ready for the WordPress.org Plugin Directory: passes Plugin Check with no errors, the plugin's web address points to the public support page, and the plugin description no longer calls forms \"non-compliant\".<\/li>\n
                  • Updated the translation template (it still listed strings that moved to Form Marshal Pro).<\/li>\n<\/ul>\n\n

                    0.6.0<\/h4>\n\n
                      \n
                    • Added support for Fluent Forms (with Fluent Forms Pro) and Forminator: scanning, blocking, stored entries, and live editor warnings.<\/li>\n<\/ul>\n\n

                      0.5.0<\/h4>\n\n
                        \n
                      • Live warnings in the Ninja Forms, WPForms, and Contact Form 7 form editors.<\/li>\n
                      • The network dashboard and minimums, daily digest, webhook, monitoring endpoint, and audit log export move to Form Marshal Pro. Their settings carry over when Pro is added.<\/li>\n
                      • Fixed: wp form-marshal entries purge --yes<\/code> never ran.<\/li>\n
                      • Fixed: a form's pages could be missing from the report after pages were saved and forms scanned in the same run.<\/li>\n<\/ul>\n\n

                        0.4.0<\/h4>\n\n
                          \n
                        • Added support for Ninja Forms, WPForms, and Contact Form 7.<\/li>\n<\/ul>\n\n

                          The full history is in CHANGELOG.md.<\/p>","raw_excerpt":"Finds forms that collect health or personal information, explains why, and blocks the ones that should not run. Works with six form plugins.","jetpack_sharing_enabled":true,"_links":{"self":[{"href":"https:\/\/wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin\/381837","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin"}],"about":[{"href":"https:\/\/wordpress.org\/plugins\/wp-json\/wp\/v2\/types\/plugin"}],"replies":[{"embeddable":true,"href":"https:\/\/wordpress.org\/plugins\/wp-json\/wp\/v2\/comments?post=381837"}],"author":[{"embeddable":true,"href":"https:\/\/wordpress.org\/plugins\/wp-json\/wporg\/v1\/users\/bpmore"}],"wp:attachment":[{"href":"https:\/\/wordpress.org\/plugins\/wp-json\/wp\/v2\/media?parent=381837"}],"wp:term":[{"taxonomy":"plugin_section","embeddable":true,"href":"https:\/\/wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin_section?post=381837"},{"taxonomy":"plugin_tags","embeddable":true,"href":"https:\/\/wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin_tags?post=381837"},{"taxonomy":"plugin_category","embeddable":true,"href":"https:\/\/wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin_category?post=381837"},{"taxonomy":"plugin_contributors","embeddable":true,"href":"https:\/\/wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin_contributors?post=381837"},{"taxonomy":"plugin_business_model","embeddable":true,"href":"https:\/\/wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin_business_model?post=381837"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}