Gravity Forms Trusted Values Setup Guide

The Gravity Forms Trusted Values Premium Add-on lets a form field get its value from your server instead of from the visitor’s browser. A field can be filled in on the server when the form is sent, without ever being part of the page, or a Hidden field can be locked to its default value. This guide covers installation, every setting, what happens when a browser sends another value, the overview page and answers to common questions.

Why values from the browser cannot be taken on trust

A form page is a document the visitor’s browser holds. Hidden fields, Administrative fields with dynamic population, default values and calculation formulas are all in that document, and the browser’s developer tools can read and change them before the form is sent. A visitor can also add inputs that were never on the page. Gravity Forms then receives what the browser sent.

For most fields that is exactly right: the visitor’s name is whatever the visitor typed. For some fields it is not. A price list code, a sales rep’s address used for routing, a rate inside a quote formula, the account e-mail of a signed-in customer or the page a lead came from should come from you, not from the browser. Trusted Values moves those fields to the server.

Requirements and installation

1. WordPress 6.5 or newer, PHP 7.4 or newer and Gravity Forms 2.8 or newer (tested with 2.9 and 3.1).
2. Go to Plugins → Add New → Upload Plugin, choose the zip file and click Install Now, then Activate.
3. Go to Forms → Settings → Trusted Values, enter your license key and click Activate License. The field settings, the form settings section and the Forms → Trusted Values page appear once the licence is active.

The add-on needs no account with any outside service and sends no data anywhere. The only requests it makes are the GravityExtra licence check and update check.

Which fields can hold a trusted value

Hidden, Single Line Text, Paragraph Text, Number, E-mail, Phone and Website fields. A Number field that uses a Gravity Forms calculation keeps its own calculation; use a hidden formula instead (see below) if the formula itself should stay private. Locking to the default value is offered for Hidden fields.

Step 1: choose a trusted value for a field

Open the form in the form editor, click the field and open the Advanced tab. Under Trusted value choose one of three options:

• Off: the field works as usual and takes what the browser sends.
• Set on the server only: the field is left out of the form page and filled in on the server when the form is sent.
• Locked to the default value (Hidden fields): the field stays on the page as a hidden input, and its default value is worked out again on the server when the form is sent.

Step 2: where a server-only value comes from

With Set on the server only, choose Value from:

Signed-in user

Pick the detail: user ID, username, e-mail address, display name, first name, last name or roles (a comma-separated list). The value comes from the account of the person who sends the form, so a visitor cannot send another customer’s e-mail address. For visitors who are not signed in the value is empty.

User meta (custom key)

Type the meta key, for example company or member_number. Lists are saved as a comma-separated list. Private keys are never read: keys that look like passwords, tokens, sessions, keys, hashes, activation codes or capability data return an empty value.

Page the form is on

Pick title, address (URL), ID, slug or post type. When the form is shown, the add-on adds a short signed value with the page ID to the form. When the form is sent, the signature is checked with a secret that only your site knows, so the page cannot be swapped for another one, and AJAX forms (which are sent to a different address) still get the right page. If the signature does not match, the page values are empty.

Page custom field (meta key)

Type the meta key of the page, for example region or campaign_code. This is a simple way to give one form a different value on each landing page. Keys starting with an underscore and private-looking keys are never read.

Fixed text

Any text, such as an internal e-mail address for notification routing, a cost centre, a supplier code or a price list name. The text is saved in the form settings and never sent to the browser.

Date and time of sending

Type a PHP date format, for example Y-m-d or Y-m-d H:i. The time is taken in your site time zone (Settings → General) at the moment the form is sent.

Hidden formula

Type a formula in the same syntax as Gravity Forms calculations: merge tags of other fields and the operators + – * / ^ with brackets. For example:

{Cases of 24:3} * 12.40 + 35

Choose Round to 0 to 6 decimals, or leave it unrounded. The formula is worked out on your server from the answers in the submission, after the other trusted values are filled in, so a formula can use them too. Number fields with the 9.999,99 format get a comma as the decimal separator. Only the result is saved; the formula is never part of the page.

The reader is deliberately small: numbers, merge tags, + – * / ^ and brackets. Anything else (functions, letters, unknown merge tags) makes the formula invalid, and the field is saved empty. Division by zero gives 0, as Gravity Forms calculations do.

Locked Hidden fields

A locked Hidden field stays on the page with its default value, which is useful when the value is not secret but must not change, such as a campaign name or a price list code that your notifications and feeds rely on. When the form is sent, the default value is worked out again on the server (merge tags included, with the signed page as the embed page) and replaces what the browser sent. Values added to the link through dynamic population are not used for a locked field; if a value has to come from the request, use a server-only source instead.

Gravity Forms 3.0 and newer already refuse a changed value for Hidden fields created in the 3.x form editor, unless dynamic population is on. A locked field goes one step further: it saves the right value instead of stopping the visitor, works on older fields and on Gravity Forms 2.8 and 2.9, and records the change.

What happens when the form is sent

1. Before Gravity Forms validates the submission, the add-on works out every trusted value of the form.
2. The trusted values replace whatever the browser sent for those fields. Server-only fields are never required and never show an error, because visitors cannot fill them in.
3. Gravity Forms validates and saves the entry as usual, so conditional logic, calculations, confirmations, notifications and feeds all use the trusted values.
4. If the browser sent something different for a trusted field, the change is recorded on the new entry.

For a server-only field, any value the browser sends counts as a change, because the page never had an input for it. An empty value does not. For a locked field, a value that differs from the default value counts as a change.

When the browser sent another value

The entry keeps the trusted values in every case. In addition:

• a note on the entry names the fields, for example “Price list (#4), Quote total (#6)”;
• the entry list gets a Changed in browser column and filter (choose it under the column picker or in the search filter);
• the entry page shows a Trusted Values box with each field and what the browser sent (shortened to 200 characters);
• notifications with the event Trusted value changed in the browser are sent, for entries that are not spam.

Form setting: note only, or mark as spam

Go to Form Settings → Trusted Values. When the browser sends another value has two choices: save the trusted value and add a note (the default), or save the trusted value, add a note and mark the entry as spam. Spam entries do not send the usual notifications and do not run feeds. The same page lists the trusted fields of the form and where each value comes from.

An alert notification

To hear about changed values straight away, add a notification under Form Settings → Notifications and choose the event Trusted value changed in the browser. Send it to the person who looks after the site. Merge tags work as in any notification, so the subject can include {entry_id}.

Forms → Trusted Values

This page lists every form with trusted fields: each field, where its value comes from, whether it is on the page, and how many entries arrived with a changed value (spam included), with a link to those entries. Formulas and fixed text are never shown on the page. It is open to users who can view Gravity Forms entries and to administrators.

Examples

Wholesale quote with a private rate

A quote form asks for the number of cases. A server-only Number field “Quote total” uses the hidden formula {Cases of 24:3} * 12.40 + 35 rounded to 2 decimals. The confirmation shows the estimate, and the rate never appears in the page.

Routing to an internal address

A server-only Hidden field “Sales desk” holds fixed text with the sales team’s address. The notification sends to the field’s merge tag, so the address can change in one place and is never visible to visitors.

Member requests

For signed-in members, server-only fields take the account e-mail, the member number from user meta and the roles. Staff can be sure the request belongs to the account that sent it.

One form on many landing pages

Each landing page has a custom field campaign_code. A server-only field reads it from the signed page, so the entry records the campaign of the page the visitor actually used.

Things to know

• Server-only values are saved in the entry like any other answer, so they appear wherever you use the entry: notifications, confirmations, feeds, exports and the entry screen. Only the form page leaves them out.
• A server-only field has no input on the page, so the browser cannot use it in conditional logic or calculations while the visitor fills in the form. Gravity Forms still evaluates conditional logic on the server when the form is sent.
• Editing an entry on the entry screen works as usual; the add-on only acts on form submissions.
• Save and Continue works: values are worked out again when the form is finally sent.
• Forms sent through the Gravity Forms API (GFAPI::submit_form and the REST API submissions endpoint) get the same treatment. They have no signed page, so page values are empty there.
• If the licence is not active, trusted fields behave as plain Gravity Forms fields. Formulas and fixed text still never reach the page.

Frequently asked questions

Can visitors see a server-only value?

Not on the form page: the field is not part of the page. If you show the value in a confirmation, the visitor sees it there.

Does this replace the Gravity Forms honeypot or a CAPTCHA?

No. Those stop automated spam. Trusted Values makes sure certain fields hold your values, whoever sends the form.

Can I use a trusted value in another field’s calculation?

A hidden formula can use other trusted values. A normal Gravity Forms calculation runs in the browser too, where server-only values are not available, so use a hidden formula for anything that depends on them.

What about values added to the link (query strings)?

Query strings come from the browser, so they are not trusted. Locked fields ignore them; for values that must depend on the page, use a page custom field.

Does it work with AJAX and multi-page forms?

Yes. The signed page travels with the form, and values are worked out on every page submission and again on the final one.

What is removed when I uninstall the add-on?

The add-on settings and the licence data. Entries, their notes and marks, and the field settings saved in your forms are never touched.

Need help?

See the Trusted Values add-on page for plans, or contact GravityExtra support from your account with the form export and a short description of what you expected.