How to Keep Gravity Forms Field Values Out of the Browser

Open any form page, press F12, and the browser shows you everything the form carries: every Hidden field and its value, the default values, the calculation formulas, the inputs Gravity Forms will send back. Change a value there and the form sends the new one. For a name or a message that does not matter. For a price list code, an internal routing address or the rate inside a quote, it does.

This guide explains which values in a Gravity Forms form a visitor can change, the usual ways people try to hide them and where each falls short, and how to keep chosen field values on your server so the browser never sees them and never decides them.

What the browser can see and change

A form page is a document the visitor’s browser holds. Everything in it can be read and edited before the form is sent:

• Hidden fields. Hidden from view, not from the page code. The value sits in the HTML as an input.
• Default values. Whatever a merge tag filled in when the page was built, such as the signed-in user’s e-mail address, is in the page.
• Calculation formulas. Calculations run in the browser, so the formula and every number in it are in the page.
• Administrative fields with dynamic population. Normally left out of the page, but once dynamic population is on they are rendered so the value can travel with the form.
• Inputs that were never there. A visitor can add an input with the name of any field and a value of their choice.

The Gravity Forms community forum has asked about this for years. In 2020 a thread on hiding form fields completely, so they are not visible in developer tools, collected more than five thousand views; the concern was that hidden values ended up in a generated PDF and were easy to alter. In 2025 someone asked how to build a quote form whose prices stay hidden from Inspect Element, and in 2026 another person asked how to keep an Administrative field out of developer tools. The answer each time was code: set the value on the server when the form is sent.

Why it matters

Most visitors never open developer tools. The ones who do are often exactly the ones you want to keep an eye on. A few examples of what a changed value can do:

• Prices and quotes. A quote form that multiplies cases by a trade rate shows the rate in the formula. Change it, and the quote total in the entry, the confirmation and the PDF follow.
• Routing. A Hidden field with the sales rep’s address decides who gets the notification. Change it, and the lead goes elsewhere, or a message goes to an address of the visitor’s choice.
• Identity. A form that fills in the signed-in customer’s account e-mail can be sent with another customer’s address, and the request looks as if it came from them.
• Attribution. A campaign code or the page a lead came from can be swapped, which spoils your reports.
• Feeds. CRM, spreadsheet and webhook feeds pass the values on. A changed value lands in every system downstream.

The usual workarounds

Use an Administrative field

Administrative fields are not rendered on the form page, which keeps the value out of the browser. But an Administrative field has no value unless someone fills it in on the entry screen, or dynamic population is switched on, and then it is rendered again. On its own it is a field for staff, not a way to give a submission a trusted value.

Rely on the Gravity Forms state check

Gravity Forms 3.0 and newer check Hidden fields created in the 3.x form editor and refuse the submission when the value was changed, unless dynamic population is on. That is a real improvement. It does not hide the value, it does not cover older fields or Gravity Forms 2.9 and earlier, and the visitor sees an error rather than the right value being saved. It also does not help with formulas or with values that should depend on the signed-in user.

Write code for every form

A small filter that sets a field on the server works well, and is the answer you will usually get on the forum. It means a code snippet per form and per field, a developer for every change, and no record of whether anyone tried to send another value.

Check the values later

Some teams compare important values by hand on every entry. That catches some problems after the notification went out and the feed already ran, and costs time on every entry.

Keep the values on the server

The Gravity Forms Trusted Values Premium Add-on turns the code answer into a setting on the field. Open a field in the form editor, go to the Advanced tab and choose a trusted value. A server-only field is left out of the page and filled in on your server when the form is sent; a locked Hidden field gets its default value back on the server.

A server-only value can come from:

• the signed-in user: ID, username, e-mail address, display name, first and last name or roles;
• a user meta key, such as a member number or company name (private keys are never read);
• the page the form is on: title, address, ID, slug or post type, signed into the form so AJAX forms get it right;
• a page custom field, so one form can carry a different code on each landing page;
• fixed text, such as an internal address or a price list name;
• the date and time of sending, in your site time zone;
• a hidden formula in Gravity Forms calculation syntax, with rounding. The formula stays on your server.

Step by step: a quote form with a private rate

1. Build the visible part of the form as usual: name, e-mail, the number of cases and a notes field.
2. Add a Number field called “Quote total”. On its Advanced tab choose Set on the server only, Value from Hidden formula, type {Cases of 24:3} * 12.40 + 35 and round to 2 decimals.
3. Add a Hidden field “Sales desk” set on the server only with Fixed text: the sales team’s address. Use its merge tag as the notification recipient.
4. Add a Hidden field “Account e-mail” from the Signed-in user, e-mail address, so a request from a customer account is tied to that account.
5. Show the estimate in the confirmation with the merge tag of “Quote total”.
6. In Form Settings → Trusted Values choose whether a changed value only adds a note, or also marks the entry as spam.
7. Send a test entry, then look at the page source: the rate, the formula and the internal address are not there.

When someone changes a value anyway

Whatever the browser sends for a trusted field is replaced before Gravity Forms validates the submission, so the entry, the confirmation, notifications and feeds all use your values. If the browser did send something else, you see it:

• a note on the entry names the fields that were sent with another value;
• a “Changed in browser” column and filter in the entry list;
• a box on the entry page with what the browser sent;
• an optional notification event, “Trusted value changed in the browser”, to alert whoever looks after the site;
• an optional form setting that marks such entries as spam, so they never reach your feeds.

Forms → Trusted Values lists every trusted field of every form and how many entries arrived with a changed value, which makes it easy to see whether anyone is trying.

Good practice for values that matter

• Decide what the visitor may choose. Their own answers come from the browser by definition. Prices, routing, account details and attribution usually should not.
• Keep formulas that use private numbers on the server. A browser calculation is fine for a live total the visitor can see; the saved total should come from a hidden formula.
• Prefer the signed-in account over a typed address for anything tied to a customer record.
• Do not trust query strings for anything important; use a page custom field on the landing page instead.
• Watch the changed-value count after launching a new form. A sudden jump tells you someone is testing it.

Frequently asked questions

Does this hide the value from the visitor completely?

It keeps the value out of the form page. If you show the value in a confirmation or send it to the visitor by e-mail, they see it there, which is often what you want for a quote total.

Does it slow the form down?

No. The work happens once on your server when the form is sent, and server-only fields make the page slightly smaller.

Is this a replacement for spam protection?

No. Spam protection stops automated submissions. Trusted values make sure certain fields hold your values whoever sends the form. They work well together.

Does it send data to an outside service?

No. Everything runs on your own site.

Next steps

Look at your busiest form and list the fields a visitor should not decide. The setup guide explains every source, the hidden formula syntax and the change alerts in detail. Choose a trusted value for each of those fields, send a test entry, and check the page source. See the add-on and its plans.