How can we help you?

Video walkthrough

1:33

Let Users Edit Their Gravity Forms Entry with a Secure Link
Video walkthrough: let people edit their own Gravity Forms entry with a secure personal link. Watch on YouTube

People make typos, change their plans and forget details. The Gravity Forms Secure Edit Link & Client Portal Premium Add-on lets them fix their own entries: a personal, signed link in your notification opens your form filled in with their answers. Only the fields you allow can change, Gravity Forms validation runs as usual, the same entry is updated and every change is logged in the entry notes.

This guide covers installation, form settings, the merge tags, the client portal, security, the limits of version 1.0 and troubleshooting.

Step 1: Install and Activate Your License

1. In WordPress go to Plugins → Add New → Upload Plugin, upload the add-on ZIP file and click Activate.
2. Go to Forms → Settings → Secure Edit, paste your GravityExtra license key and click Activate License.
3. Under Pages, choose the edit page and the client portal page, or click Create the page for me. The edit page contains [ge_edit_entry]; the portal page contains [ge_client_portal]. If you skip this, the edit page is created the first time a link is sent.

Step 2: Turn On Secure Editing for a Form

Open the form and go to Settings → Secure Edit.

• Allow editing through a secure link turns the feature on for this form.
• Link valid for (days): each link stops working after this many days (1 to 365, default 7).
• Allow edits until: optional deadline counted from the submission date (0 = no limit).
• Who can edit: anyone with the link, only the logged-in user who submitted the entry, or logged-in users with the roles you tick.
• Editable fields: tick the fields people may change. Leave all unticked to allow every supported field. Payment, file upload, signature, consent and calculated fields are never editable.
• Stop the link after one save: makes each link single-use.

Step 3: Add the Link to a Notification

Edit a notification (for example the confirmation email to the person who submitted the form) and add the merge tags from the merge tag list:

• {ge_edit_link}: the personal edit link for this entry.
• {ge_edit_link_expires}: the date the link stops working.
• {ge_portal_link}: the address of your client portal page.

Need to change something? {ge_edit_link}
This link works until {ge_edit_link_expires}.

When the person opens the link they see your form, filled in with their answers, limited to the editable fields. They change what they need and click Save changes.

Step 4: Choose What Happens After an Edit

• Every edit adds an entry note with the changed fields (old and new values, or only the field names if you turn values off).
• For an email on every edit, create a notification with the event Entry is edited (secure link or portal). The {ge_edit_changes} merge tag lists the changed fields.
• Send the “Form is submitted” notifications again: optional; their conditional logic is checked against the updated entry.
• Run the form feeds again: optional, for CRM, email marketing and webhook feeds. Payment feeds never run again. Some feed add-ons create a new record instead of updating the old one, so test one edit first.
• Message after saving: the text shown after a successful save (merge tags allowed).

Step 5: Set Up the Client Portal

In each form you want to list, turn on List entries of this form in the client portal and choose the email field used to match entries. Then share the portal page (or add {ge_portal_link} to your notifications).

• Logged-in users see the entries they submitted and, when an email field is selected, the entries with their account email.
• Visitors without an account enter their email address and receive a single-use login link valid for 30 minutes. The answer on screen is the same whether or not entries exist, so the portal never reveals who submitted a form.
• Each row offers View, Edit (when the form's access rules allow it) and, with Gravity PDF, Download links for the PDFs of that form.

Security

• Links are signed with a random key stored on your site (HMAC-SHA256) and contain only the entry number, the expiry time and a random link ID: no name, email or other personal data.
• Revoke all links for this entry in the entry screen stops every link sent for that entry. Revoke all links in the add-on settings stops every link and portal session on the site.
• Fields that are not editable are removed from the form for that request, so they cannot be changed even by a modified form submission. A rejected or expired link never creates a new entry.
• Rate limits: invalid links per IP address (default 10 per 15 minutes), login emails per address and per IP address, saves per entry.
• Edit and portal pages send no-referrer and noindex headers, and the edit page is kept out of automatic page menus.

Not Included in Version 1.0

• Editing of payment, file upload, signature and consent fields.
• Multi-page forms are shown as one page while editing.
• PDF downloads need the Gravity PDF plugin.

Troubleshooting & FAQ

Resource Hub