Form Marshal

Website forms are easy to build and easy to get wrong. A form that asks for a diagnosis, a date of birth next to a name, or answers to a depression screening questionnaire turns a website into a place that stores health information. Most form plugins store every answer in the WordPress database, unencrypted, and none of them signs a business associate agreement. Form Marshal checks every form on the site and tells you which ones collect protected health information (PHI) or personally identifiable information (PII), field by field, in plain sentences. In Block mode it turns off the forms that should not be running, on every page they appear on, and refuses their submissions, with a time-limited exception process for the cases that need one. Form Marshal is a control, not a compliance guarantee. It flags likely problems and gives administrators tools to act. It does not certify that a site meets HIPAA or any other rule. Works with

• Gravity Forms
• Ninja Forms
• WPForms
• Contact Form 7
• Fluent Forms (and Fluent Forms Pro)
• Forminator

Finds

• Every form, every field: field types, labels, descriptions, placeholders, choices, hidden fields, the pages each form is placed on, and where answers go (emails, add-ons, redirects).
• Four classes: clear, PII, PHI, and PHI (screening instrument), with a severity. Screening questionnaires such as PHQ-9 and GAD-7 count as PHI even without a name field, because form plugins record the time and often the IP address with every answer.
• Stored answers, safely: optional sampling of up to 100 stored entries per flagged form, checked for patterns such as Social Security numbers, dates of birth, and health words. Only the pattern name and a count are kept, never the answer.

Blocks

• Block mode replaces a flagged form wherever it appears with a short message and refuses its submissions before anything is stored, emailed, or sent on. Turn it on in the settings when you are ready. Flag mode, the default, only reports.
• Exceptions: an editor asks for one with a reason; an administrator approves it for a limited time, with an optional retention limit for stored entries. Exceptions end on their own.
• Editor warnings (all six form plugins): while a form is being built, a status box and notes under each field say what was found.

Reports and acts

• A report of every form with its status, evidence, entries, where data goes, and the pages it appears on.
• A page per form with findings by field, in plain sentences.
• Stored entries: set a retention period, export to CSV and delete only exported entries, or mark as reviewed. New entries and drafts stay after export. Every action asks for confirmation and is recorded in an audit log.
• An admin notice with your organization's policy, with optional acknowledgment.
• Email notices when a form becomes PHI or is blocked, and for exception requests.
• WP-CLI commands for scanning, reporting, exceptions, and entries.
• A policy filter (form_marshal/policy) so an organization can ship its own settings and lock them.

Form Marshal Pro A separate paid add-on for organizations with many sites or auditors to answer: a compliance report to print, save as PDF, or download as Markdown, a network dashboard and minimums for multisite, a daily digest email, a signed webhook, a monitoring endpoint, and audit log export. Form Marshal itself is complete without it. Privacy

• Form Marshal never stores, logs, emails, or displays a form answer. Findings hold field IDs, tags, and counts. A test checks that a seeded Social Security number appears nowhere after a scan.
• It makes no requests to outside services and sends no usage data.
• It deletes nothing on its own: retention changes, exports, and purges are administrator actions with a confirmation. Exports stream to the browser and are never written to the server.

1. Install a supported form plugin: Gravity Forms 2.7 or newer, Ninja Forms, WPForms, Contact Form 7, Fluent Forms, or Forminator.
2. Install and activate Form Marshal.
3. Review the results. The default is Flag, so nothing is blocked yet. When you are ready, go to the settings and set enforcement to Block.
4. Open Forms > Form Marshal (or Tools > Form Marshal if Gravity Forms is not installed) and review the report.

On multisite, network-activate to cover every site.

0.8.0

• New installs start in Flag mode: forms are reported, and nothing is blocked until an administrator chooses Block.
• Sites that used an earlier version keep Block as their default, so the update unblocks nothing. A mode you chose stays as chosen.
• The mode menus start with a "Default" choice that shows what the site follows when it has no mode of its own.
• On multisite, Form Marshal Pro can set a network default mode. Sites follow it unless they choose their own.

0.7.0 Security fixes from two whole-plugin scans, plus the unreleased 0.6.3 and 0.6.4 work.

• Drafts and plugin storage posts no longer decide a form's class or appear under "Embedded on".
• Exceptions and dismissals end when a form's fields, notifications, confirmations, or logic change. Ones saved by earlier versions keep working until they expire.
• Approving an exception covers only the form version the approver saw. The wp form-marshal exceptions approve command now needs --form-hash.
• A full scan never lifts a block, and Gravity Forms editors see only Gravity Forms forms.
• Network sampling minimums hold, long submissions no longer stall scans, and CLI exports are private from creation.
• Export and purge deletes only the entries included in a completed CSV. New entries and drafts are kept, and a failed or incomplete export deletes nothing.
• A failed scan keeps the last complete decision, and an older scan cannot replace a newer one.
• Network activation stays within its network. Network deactivation clears plugin schedules across that network while keeping data.
• Adds fingerprints for Form Marshal Pro team reviews. They store no form text.

0.6.2

• The policy alert can always be hidden by each user: "I have read this" when acknowledgment is required, "Dismiss" otherwise. It returns when the message changes.
• Security hardening: the message shown in place of a blocked form is escaped again after the form_marshal/block_markup filter, status badges are escaped where they are printed, and the report's Filter button checks a nonce and the user's permission.

0.6.1

• Ready for the WordPress.org Plugin Directory: passes Plugin Check with no errors, the plugin's web address points to the public support page, and the plugin description no longer calls forms "non-compliant".
• Updated the translation template (it still listed strings that moved to Form Marshal Pro).

0.6.0

• Added support for Fluent Forms (with Fluent Forms Pro) and Forminator: scanning, blocking, stored entries, and live editor warnings.

0.5.0

• Live warnings in the Ninja Forms, WPForms, and Contact Form 7 form editors.
• The network dashboard and minimums, daily digest, webhook, monitoring endpoint, and audit log export move to Form Marshal Pro. Their settings carry over when Pro is added.
• Fixed: wp form-marshal entries purge --yes never ran.
• Fixed: a form's pages could be missing from the report after pages were saved and forms scanned in the same run.

0.4.0

• Added support for Ninja Forms, WPForms, and Contact Form 7. The full history is in CHANGELOG.md.