Security/SSL options.

Specifically 2 things:

1) The ability to choose to redirect users to ssl version of the page/form (checkbox option on the form config would work).

2) The ability to restrict form fields from being emailed. Absolute Form Processor .NET will encrypt specific fields and not include them on the email. The form admin has to visit the backend to access the encrypted info. This is particularly useful to us as we take SSN and student ID information in forms. Today our admissions application is handled this way and admissions staff log into the backend to get the full student data.

Thought I'd bump this, I'd love to see where SSL (and possibly encrypt) is on the roadmap.

@Carl - really looking forward to an option to flag certain fields to be encrypted!

In the meantime can I get your thoughts on a couple of things?

1) If I needed to do this (i.e. for a social security number field, etc) before the feature is available in GF, would I just create the form as usual and then go into MySQL and click a magic button to add encryption to that certain field/column?

2) Let's say my confidential field/column in MySQL is encrypted after the form is submitted via SSL... what about viewing the the form submissions in the WP Admin? Should I make my WP Admin only accessible via SSL or would viewing the confidential data in the (password protected) WP Admin be enough?

I completely understand that things are only as secure as my host, WP install and the MySQL DB Server I'm using but really interested in kind of a step-by-step approach you would consider if (for example) a client asked rocketgenius to perform this task using GF.

Thank you for your time! - Alex

@Carl - this is great news! Thanks so much for clarifying!

Once the API hooks are in place will someone be kind enough to give an example on how to implement them? :-D

Also, does/will Gravity Forms v1.5 have any API hooks to force SSL when viewing form data/entries in the admin or would the only option be to make the entire WP Admin only viewable over SSL?

Thanks for answering all of these questions... they're extremely important and it's much appreciated! - Alex

Found this plugin to do some of the things people are requesting in this forum. Hope it helps someone out!

Wordpress HTTPS

http://wordpress.org/extend/plugins/wordpress-https/

Thanks for the Hooks, Carl! We were able to code up an encryption/decryption routine and add checkboxes in the admin for turning it on/off per field.

There are still a few SSL issues when using the [gravityform] shortcode (at least when running the site on Nginx reverse proxy to Apache). The form action was using the http version of the page we were viewing instead of the https version (which is what we had pulled up). We fixed those with a dirty str_replace on the output and there probably is a cleaner way, but I was in a hurry and the site was already live. However, if your intention is to always post a gform back to the page being viewed, you can just output action="" instead of supplying the URL of the page there.

A client asked me to encrypt the data being stored by one of their GF forms as described in this thread. They wanted the form values encrypted in the database, a few non-sensitive values added to the notification email and the ability to view the unencrypted values in the admin panel.

The examples on the pages listed below didn't work:
http://www.gravityhelp.com/documentation/page/Gform_save_field_value
http://www.gravityhelp.com/documentation/page/Gform_get_field_value

There were 3 main problems:

1) The admin panel listed decrypted data on the entries list, but encrypted data on the entry details page.

2) Some fields like radio and checkbox values, once encrypted, were too long and truncated in the db, thus impossible to decrypt.

3) Some fields were combined with other values, both encrypted (e.g. First + Last Name) and decrypted (e.g. map link for address fields) when returned for display on the entry details page.

I decided to store radio, checkbox and select values unencrypted as they are unlikely to contain sensitive data. Also, I needed to email some non-sensitive fields, and only encrypt certain forms.

Here's my solution, in case it's helpful to someone:
http://pastebin.com/LbMEDbeR

I'd like to know when a new release comes out that supports these requests....

not sure if this helps as someone mentioned above... I have a certificate on a clients site..

I used this simple code to force ssl on wp-amin login and the dashboard area for safe measure

define('FORCE_SSL_ADMIN', true); put in the wp config file..
http://codex.wordpress.org/Administration_Over_SSL

I then had to use the plugin as mentioned above to get the pages to show correctly in google chrome browser without errors..
http://wordpress.org/extend/plugins/wordpress-https/screenshots/

This is the form page https://greenprintlawns.com/easy-pay/

Here were some of the errors that I was getting
http://logoicons.s3.amazonaws.com/httpsadmin.png

I had this error problem in the admin area even with the plugin in chrome browser... It was the logo above the dashboard being http... so just uploaded and hosted the logo at the link below to take care of that..
http://www.sslpic.com/

little off topic there but may as well fix the ssl on the whole site :)

Ps... that wordpress https plugin will give you the option to force ssl on certain pages only.. little buggy though so I just did it globally

have to play with the setting a bit and if using chrome will need to clear cookies and close and reopen browser after making changes
http://logoicons.s3.amazonaws.com/httpssettings.png

kill this - I was looking at the wrong plugin... got it going.

Hi, has there been any movement on being able to encrypt fields as an add on.

I too am very interested in excluding one or two fields, or automatically encrypting the output to the email (starred-out entries when emailed would be perfect).

The ability to send {all_fields} via email is great (and looks very elegant), but if certain fields could be excluded from the email, that would help keep our customers' information secure by keeping it on our site, and nowhere near email.

As Shelley mentioned in the original post she would be changing the form regularly, and we will too. I don't want to have my client to re-generate the list of fields manually (we've got 220 now, and that will increase to 3-400 next month, with all the values changed).

Allowing us to opt out of a field or two would even mean we don't need the encryption (we use SSL on the site anyway).