Skip to main content

Protocols in Place to Protect Your Data

Gravity PDF includes a number of protections against unauthorised access to your PDFs. All PDFs are rendered on your web server, and no third-party service has access to your data.

After installing the plugin, review the security settings and test they work as you expect.

Default Security​

tl;dr

The user who submits an entry can view their own PDF, using their user account or a matching IP address. Site Administrators and Network Super Administrators can view all PDFs.

By default, these users can access PDFs:

  1. Administrators, and Super Administrators on multisite, can access all PDFs.

  2. Any user whose WordPress role has the gravityforms_view_entries capability can access all PDFs. By default, this is only Administrators and Super Administrators. To change this, update the User Restriction setting, or add the capability to a role with a role editor plugin.

  3. The entry owner (the user who completed the form) can access their PDF:

    • If the user's IP address matches the one saved with the entry, they can view the PDF. IP addresses can change, so this only works for logged out users for 20 minutes after submitting the form. Change this with the Logged Out Timeout setting.
    • If the IP address doesn't match or the timeout has passed, and the owner was logged in when completing the form, they're redirected to a login page. Once logged in, they can view the PDF if their user ID matches the one saved with the entry.
    • If the user is already logged in, their user ID is checked without logging in again.
    • To test this, submit a new entry using a web proxy like hide.me, so that the IP address differs from your own.
warning

By default, Gravity Forms doesn't handle proxy-based IP addresses (like Cloudflare, load balancers and WAF firewalls), so IP matching won't work. To fix this, use the gform_ip_address filter to return the correct IP address, or use signed PDF URLs instead.

  1. Signed PDF URLs are an alternative to IP-based authentication. Anyone with the link can view the PDF until it expires, even if you've disabled IP addresses using Gravity Forms Personal Data settings.
    • Add the signed attribute to the [gravitypdf] shortcode or the :signed modifier to the PDF merge tag.
    • A shortcode's URL isn't signed if the entry comes from a URL parameter (like a Page Confirmation) or a merge tag other than {entry_id}, or if the author of the post or page can't view the entry. See when the shortcode signs the URL.
    • URLs last 20 minutes by default. Change this globally with the Logged Out Timeout setting, or per link with the expires attribute or modifier, up to 1 year.
    • Once expired, the standard security policies in #1/2/3 above apply.

PDFs and the File System​

tl;dr

PDFs saved to disk are only kept for a limited time, and are protected from direct access on Apache and Litespeed web servers. Other servers aren't automatically protected, so use the gfpdf_tmp_location filter to move the PDF directory outside your public directory.

During form submission, a PDF is only saved to disk if it's attached to a notification or you've used the gfpdf_post_save_pdf action. It's saved in /wp-content/uploads/PDF_EXTENDED_TEMPLATES/tmp/ by default, and deleted once the submission is complete. The next scheduled cron cleanup also deletes any files in this directory older than 12 hours.

When viewing or downloading a PDF from the admin area, the [gravitypdf] shortcode or a merge tag, the PDF is generated on request and isn't saved to disk.

When sending notifications from code or generating PDFs with the API, the PDF is saved to the temporary directory and reused for about 12 hours, depending on your cron schedule. We strongly recommend deleting it once you've finished with it. This reduces the chance of unauthorised access, and stops an outdated PDF being reused if the entry is updated. The gfpdf_override_pdf_bypass filter also fixes the outdated PDF problem.

Prevent Owner Access​

If the end user should never see a PDF, enable Restrict Owner. Only logged in users with a capability set in the User Restriction setting can then access it.

Enable Public Access​

Enable Public Access lets anyone in the world access the form's PDFs, and search engines may index them even though they're discouraged from doing so. Use it sparingly. The standard security is enough in most cases.

Last updated on