Gravity Forms
+ Exam Integrity for Quizzes

Gravity Forms is a good way to run quizzes, tests and certification checks, but a form on its own has no idea whether a student copied the questions into another tab, pasted an answer from a chat window or kept working after the time was up. The Gravity Forms Exam Integrity for Quizzes add-on adds a per-form exam mode: a set of browser controls that deter casual cheating, plus a record of what happened stored on every entry.

Inside the form you can block copy, cut, paste, the right-click menu and text selection (answer boxes stay editable). Switching to another tab or window and leaving full screen are detected, the student sees a warning with a counter, and after the number of violations you set the form can keep warning, lock or submit itself. An optional Start exam screen starts the clock and can enter full screen. A time limit per form and per page shows a visible countdown and submits (or moves to the next page) at zero, and you can allow one attempt per logged-in user or per e-mail address.

The important part runs on the server. The start time is signed when the exam starts, and every violation is kept on the server and in a signed log, so a submission after the time limit, with a forged start token or with a blanked violation log is flagged or refused (your choice). Each entry gets a status of Clean or Flagged, the list of events with times, the time taken and whether it was auto-submitted, with merge tags, an entry list column, a flagged filter and an optional teacher notification. Grading by your quiz add-on is not changed. Honest limits: browser controls cannot see a second device or a phone, and there is no webcam proctoring; use the record as one input, not as proof. For Gravity Forms 2.9 and newer.

When an exam form is shown, the add-on adds a small script and a few hidden fields to that form only. When the exam starts (on page load, or when the student presses Start exam), the browser asks your server for a start token: the server records the start time and signs it with a secret key that never leaves your site. The countdown is calculated from that server time, so reloading the page or changing the computer clock does not give extra time. Every tab switch, window switch or full screen exit is sent to the server, which appends it to the attempt and returns a newly signed copy of the violation log. On submit the server checks the signature of the start token, compares the elapsed time with the limit plus your grace period, checks the signed log against its own copy, applies the violation limit and the one-attempt rule, and then either saves the entry with its integrity record or refuses it with a clear message. Required answers are only skipped for an automatic submit the server agrees was due (time up, page time up or violation limit). The record is stored as entry meta before notifications are sent, so the merge tags work in every notification. Everything happens on your own server — the add-on makes no outside HTTP request beyond the licence and update checks.