Introduction
When planning a Gravity Forms installation, many security considerations need careful attention. The advice and best practices in this section are intended to help site owners and administrators understand the issues and adjust security features to their needs.
This information complements the Gravity Forms Security Whitepaper.
Web Server and WordPress Security
Gravity Forms is only as secure as the server it’s installed on, so it makes sense to begin your security assessment and configuration by reviewing the system, the Web server, and WordPress.
Web Server and WordPress Configuration
If you are running your own Web server, make sure your server is running the latest version of PHP and the web server, and consider forcing HTTPS/SSL on all pages. Configure regular backups and follow the advice in the WordPress documentation on hardening WordPress. It contains excellent suggestions for securing the web server and mitigating risks in the event of a compromise.
You may also want to consider managed hosting, which can handle much of this for you. Refer to this Getting started with WordPress article from the Gravity Forms blog.
Security Services
The following security services provide a firewall, a first line of defense, between attackers and your server. They’re an excellent way to prevent attacks before they even hit your server:
Updates
We recommend that customers keep WordPress, plugins, and themes updated regularly as part of a maintenance plan. Not doing so is a serious security risk for your site. We also recommend that customers remove Gravity Forms from their sites if they no longer wish to keep their license active.
Gravity Forms Security Features
Once you’ve locked down the security on your server and WordPress, review the security features Gravity Forms offers and adjust them to your needs.
Automatic and Background Updates
Administrators see a notification on the WordPress dashboard to upgrade when a new release is available. If administrators have automatic background updates enabled, Gravity Forms will be updated automatically without the site owner needing to do anything on their end. This is enabled by default on all new installations from version 1.9.2 onward.
Site owners can opt to remove automatic background updates through a simple change in the Gravity Forms settings or WordPress configuration file, but keeping the functionality is strongly recommended.
Automatic background updates will only occur for important bug fixes and security releases, not for major version releases.
Fine-Grained User Permissions
When granting users access, it’s not necessary to grant them permissions to perform all functions in Gravity Forms. You can control exactly who can do what by assigning capabilities to user roles.
As a rule, it’s good practice to assign only the capabilities needed for the role, not more. See Role and Capability Management for the details.
Roles and capabilities are a security feature of WordPress, and you can read more about them in the WordPress documentation. Although capabilities are an important part of WordPress security, there’s no way to manage them without a plugin. Fortunately, there are several plugins that can do this. One that we do recommend is the Members plugin.
Require Login
Gravity Forms can be configured to be displayed only to logged-in users. If this form setting is enabled, then a message will be displayed to anonymous users. These forms are protected by special security tokens called nonces that are refreshed every 12 hours, so it’s important that pages that require login are not cached; otherwise, submissions will fail. The default settings for most caching plugins will allow this, so it should not be an issue.
Anti-Spam Protection
Spam is a special sort of security issue. Mostly it’s just annoying, but it can become a serious issue if it goes unchecked. Gravity Forms supports multiple methods for detecting spam. See the Spam Detection and Protection article for the details.
State Validation
Out of the box, Gravity Forms includes built-in form validation to help prevent spam and automated attacks. This protection is especially critical for forms that use pricing fields or integrate with payment gateways, since the validation automatically rejects submissions that attempt to send random or unexpected values to supported form fields. See the State Validation article for more details.
File Upload
For a full overview of file upload security in Gravity Forms, including upload restrictions, file storage, download access control, and off-server storage alternatives, see the File Upload Security article.
Sanitization of Data Submitted
Field values are sanitized by WordPress core functions during form submission and escaped on output.
Sensitive Data
Dynamic Population
Pages containing forms should be excluded from caching to prevent populated forms from being cached and displayed to others.
If you have a form that will collect personal data (names, email addresses, etc.), consider enabling the “Require user to be logged in” setting.
Entries
The entry data is not encrypted. This means you should not use Gravity Forms to store highly sensitive data, such as credit card details or passwords, as a data breach could result in serious issues.
The JSON REST API
Gravity Forms provides an API that administrators can activate on the Settings Page.
The API provides two methods of authentication
- For WordPress plugins and themes running in the same installation: WordPress cookie authentication.
- For external clients: signature authentication.
Cookie authentication is the basic authentication method included with WordPress. When users log in, this sets up the cookies, so plugin and theme developers need only to have a logged-in user.
The Gravity Forms Web API uses nonces in addition to authentication to prevent CSRF (Cross-Site Request Forgery). This prevents other sites from forcing you to perform actions without your explicit consent.
All requests from external applications are authenticated by checking an expiring signature. This is similar to the approach Amazon uses to secure access to its S3 Storage API. Once authenticated, standard WordPress capability-based authorization is used to ensure that the API request is allowed to be fulfilled.
If you’ve activated the Web API, make sure the private key is secure and strong. Create a dedicated API user account and assign it the minimum privileges required.
Content Security Policy
Content Security Policy (CSP) is an added layer of security that helps to detect and mitigate certain types of attacks, including Cross Site Scripting (XSS) and data injection attacks. These attacks are used for everything from data theft to site defacement to the distribution of malware.
To enable CSP, all script tags must contain a nonce attribute to be allowed to execute. As of Gravity Forms 2.5.8, script tags for the form inline scripts are now generated by WordPress 5.7+, which makes it possible to use the wp_inline_script_attributes filter to add attributes to the tag, such as the nonce required by CSP. Refer to this WordPress core team post for more details.
Verifying the integrity of the source code files
If you’re concerned that your files may have been tampered with, you can check by comparing the md5 checksums for each of the files. Checksums can be checked using the Gravity Forms CLI add-on. If you need the checksum file for a previous version, please get in touch with support and we’ll send it to you.
To verify the checksum, be sure you have the CLI add-on (and WP CLI, of course) installed and run the following command:
wp gf tool verify-checksums
Reporting Security Vulnerabilities
If you have discovered a security vulnerability in one of our products, see Information for Security Researchers for how to report it and what details to include.
If you are a customer, please refer to the How To Report a Security Issue article. We’ll acknowledge receipt as soon as we’ve read it. If confirmed, we’ll plan a patch and let you know when we plan to release it.