Gravity Forms
+ Incident & Accident Reports

Incidents are often written down in a paper book or a shared spreadsheet, and then the follow-up gets lost: names and first aid notes are visible to too many people, witnesses are asked too late, agreed actions are never checked and nobody can show later what was done. The Gravity Forms Incident & Accident Reports add-on keeps the whole record in one confidential place on your own WordPress site.

Staff, coaches or volunteers report what happened with a Gravity Forms report form: type (injury, near miss, property damage, behaviour or other), severity, date, time and location, a description, the people involved with their role, the injured areas on a front and back body map, photos and the immediate action taken. Each report becomes a case file that only incident officers can open in full, and the Gravity Forms entry is deleted so personal and medical details never show in Forms → Entries.

Officers assign an investigator, write root-cause notes, ask witnesses for a statement by e-mail with a private link that works once (typed statement and optional signature, with reminders) and add corrective actions with an owner and due date; owners get a reminder when an action is overdue. A closed case is locked, and re-opening needs a reason that goes into the audit log, which records every view, change and export. The person who reported it can check the status through a private link, and an Incident viewer role sees summaries without personal details. A PDF case report, a CSV list, counts by type, location and month, an open-actions list and a retention rule that anonymises or deletes closed cases are included. Everything runs on your own server, with no outside connection. For Gravity Forms 2.9 and newer.

The add-on creates an Incident report form with its own body map field and two photo fields; its fields are found by parameter name, so you can change labels and help text freely. When a report is sent, the add-on copies it into its own case table, moves the photos into a private folder under random names with deny-all files, and deletes the Gravity Forms entry. Case files, photos, statements, changes and exports need the incident officer capability and a security token, and each view and change is written to the audit log. Status and statement links carry an HMAC signature made with a secret key that only your site knows; a statement is saved with a single conditional database update, so its link works exactly once. Closing a case and re-opening it are conditional updates too, so a closed case cannot be changed by accident. A daily task sends witness reminders and overdue action reminders and applies your retention rule. Everything happens on your own server — the add-on makes no outside HTTP request beyond the licence and update checks.