{
    "title": "Gravity Forms",
    "seo_title": "Gravity Forms: review, recommended settings and limits",
    "h1": "Gravity Forms",
    "description": "Gravity Forms: who it is worth paying for, what Basic, Pro and Elite include, recommended anti-spam and privacy settings and patched vulnerabilities.",
    "lead": "Gravity Forms is a paid form plugin with no free version, popular with agencies for its stored entries and conditional logic. This sheet covers who it is worth the price for, what each license includes, the anti-spam and privacy settings to apply and the recent vulnerabilities to know about.",
    "language": "en",
    "locale": "en-US",
    "type": "plugin-sheet",
    "url": "https://www.wp-masquerade.com/features/camouflaged-plugins/gravity-forms/",
    "canonical": "https://www.wp-masquerade.com/features/camouflaged-plugins/gravity-forms/",
    "markdown": "https://www.wp-masquerade.com/features/camouflaged-plugins/gravity-forms/index.md",
    "json": "https://www.wp-masquerade.com/features/camouflaged-plugins/gravity-forms/index.json",
    "published": "2026-11-04T08:00:00+00:00",
    "modified": "2026-11-05T21:10:15+00:00",
    "site": {
        "name": "WP Masquerade",
        "url": "https://www.wp-masquerade.com/"
    },
    "translations": [
        {
            "language": "en",
            "hreflang": "en-US",
            "title": "Gravity Forms",
            "url": "https://www.wp-masquerade.com/features/camouflaged-plugins/gravity-forms/",
            "markdown": "https://www.wp-masquerade.com/features/camouflaged-plugins/gravity-forms/index.md",
            "json": "https://www.wp-masquerade.com/features/camouflaged-plugins/gravity-forms/index.json"
        },
        {
            "language": "fr",
            "hreflang": "fr-FR",
            "title": "Gravity Forms",
            "url": "https://www.wp-masquerade.com/fr/fonctionnalites/extensions-camouflees/gravity-forms/",
            "markdown": "https://www.wp-masquerade.com/fr/fonctionnalites/extensions-camouflees/gravity-forms/index.md",
            "json": "https://www.wp-masquerade.com/fr/fonctionnalites/extensions-camouflees/gravity-forms/index.json"
        },
        {
            "language": "es",
            "hreflang": "es-ES",
            "title": "Gravity Forms",
            "url": "https://www.wp-masquerade.com/es/funcionalidades/plugins-camuflados/gravity-forms/",
            "markdown": "https://www.wp-masquerade.com/es/funcionalidades/plugins-camuflados/gravity-forms/index.md",
            "json": "https://www.wp-masquerade.com/es/funcionalidades/plugins-camuflados/gravity-forms/index.json"
        },
        {
            "language": "de",
            "hreflang": "de-DE",
            "title": "Gravity Forms",
            "url": "https://www.wp-masquerade.com/de/funktionen/getarnte-plugins/gravity-forms/",
            "markdown": "https://www.wp-masquerade.com/de/funktionen/getarnte-plugins/gravity-forms/index.md",
            "json": "https://www.wp-masquerade.com/de/funktionen/getarnte-plugins/gravity-forms/index.json"
        },
        {
            "language": "it",
            "hreflang": "it-IT",
            "title": "Gravity Forms",
            "url": "https://www.wp-masquerade.com/it/funzionalita/plugin-camuffati/gravity-forms/",
            "markdown": "https://www.wp-masquerade.com/it/funzionalita/plugin-camuffati/gravity-forms/index.md",
            "json": "https://www.wp-masquerade.com/it/funzionalita/plugin-camuffati/gravity-forms/index.json"
        },
        {
            "language": "pt",
            "hreflang": "pt-BR",
            "title": "Gravity Forms",
            "url": "https://www.wp-masquerade.com/pt/recursos/plugins-wordpress-camuflados/gravity-forms/",
            "markdown": "https://www.wp-masquerade.com/pt/recursos/plugins-wordpress-camuflados/gravity-forms/index.md",
            "json": "https://www.wp-masquerade.com/pt/recursos/plugins-wordpress-camuflados/gravity-forms/index.json"
        },
        {
            "language": "nl",
            "hreflang": "nl-NL",
            "title": "Gravity Forms",
            "url": "https://www.wp-masquerade.com/nl/functies/gecamoufleerde-plugins/gravity-forms/",
            "markdown": "https://www.wp-masquerade.com/nl/functies/gecamoufleerde-plugins/gravity-forms/index.md",
            "json": "https://www.wp-masquerade.com/nl/functies/gecamoufleerde-plugins/gravity-forms/index.json"
        }
    ],
    "headings": [
        {
            "level": 1,
            "text": "Gravity Forms"
        },
        {
            "level": 2,
            "text": "What Gravity Forms does on your site"
        },
        {
            "level": 2,
            "text": "Which sites Gravity Forms is a good fit for"
        },
        {
            "level": 2,
            "text": "Gravity Forms strengths and limitations"
        },
        {
            "level": 3,
            "text": "Strengths"
        },
        {
            "level": 3,
            "text": "Limitations"
        },
        {
            "level": 2,
            "text": "The Gravity Forms settings we recommend"
        },
        {
            "level": 2,
            "text": "The file upload flaws that have hit Gravity Forms"
        },
        {
            "level": 2,
            "text": "Gravity Forms frequently asked questions",
            "id": "faq"
        }
    ],
    "body": "## The essentials\n\n- Best for agencies building complex forms that need stored entries and conditional logic.\n- Main caveat: no free version or trial, and payments or user registration require Pro or Elite.\n- Paid: Basic is $59 per year for one site, Pro $159 for 3 sites, Elite $259 for unlimited sites.\n\n## What Gravity Forms does on your site\n\nGravity Forms is a commercial form plugin from Rocketgenius Inc. It is not listed on wordpress.org and has neither a free version nor a trial: you buy an annual license, then enter its key under Forms > Settings to receive updates. The only way to evaluate it first is the vendor’s online demo.\n\nYou build forms with drag and drop, using more than 30 field types, columns, multiple pages, conditional logic, calculations, file uploads and save and continue. Every submission is stored in the database, where you can browse it under Entries and export it to CSV. Notifications go out through WordPress’s `wp_mail()` function, and confirmations either show a message or redirect the visitor.\n\nThe core plugin is the same on every license; what changes is the add-ons. Basic covers the email marketing and anti-spam add-ons (Akismet, Cloudflare Turnstile, reCAPTCHA), Pro adds payments (Stripe, PayPal Checkout, Square, Mollie) and Zapier, and Elite includes everything else: user registration, surveys, quizzes, signatures and partial entries. Developers get more than 500 hooks, a v2 REST API, WP-CLI commands and an MCP server for AI assistants.\n\n![Diagram: Gravity Forms works on visitors and bots, wordpress, external services. Public traces: folder name (hidden with Pro); tag IDs (hidden with Pro); JavaScript variables (still visible); CSS classes (still visible); REST routes (still visible).](https://www.wp-masquerade.com/media/wpm-sheets/gravityforms/diagram-en.svg?v=0472e6fb)\n\n## Which sites Gravity Forms is a good fit for\n\n- **Agencies and freelancers** who deliver complex forms (calculated quotes, multi-step applications, email routing based on answers) and want the same reliable tool from one client to the next.\n- **Sites that handle a lot of requests**: entries stay in the dashboard, with export, spam filtering and per-form retention rules.\n- **Custom projects**: hooks, the REST API and the add-on framework let you connect forms to a CRM or an application.\n\nIt is the wrong choice for a simple contact form on no budget, where a free plugin does the job. It is also poor value if you need a single Elite feature, such as user registration, on a small site. [WPForms](https://www.wp-masquerade.com/features/camouflaged-plugins/wpforms/) or Fluent Forms offer a free version to start with.\n\n## Gravity Forms strengths and limitations\n\n### Strengths\n\n- **Full core from Basic up.** Conditional logic, multi-page forms, file uploads and spam protection come with every license.\n- **Entries stored and under control.** CSV export, automatic deletion after a set number of days and integration with WordPress’s privacy tools.\n- **Anti-spam without a CAPTCHA.** The advanced honeypot and the submission speed check filter bots with no action from the visitor.\n- **Highly extensible.** More than 500 hooks, a v2 REST API, WP-CLI and an MCP server for custom integrations.\n- **Vendor-maintained translations.** French, Spanish, German, Italian, Dutch and Brazilian Portuguese are among the languages the vendor’s team reviews, usually every month.\n\n### Limitations\n\n- **No free version.** No trial either: the online demo is the only way to test before buying.\n- **Add-ons split by license.** Stripe and PayPal require Pro; user registration and surveys require Elite.\n- **Updates tied to the license.** Without an active key, the plugin can no longer check for updates, security fixes included.\n- **Manual major versions.** The jump from 2.x to 3.0 does not install automatically and contains breaking changes you need to test.\n- **Repeated file upload flaws.** Several critical unauthenticated vulnerabilities were fixed in 2025 and 2026.\n\n## The Gravity Forms settings we recommend\n\nGlobal settings live under Forms > Settings; a form’s own settings are under Form Settings once you open that form. The vendor recommends WordPress 7.1 and PHP 8.3, with WordPress 6.5 and PHP 7.4 as the minimum.\n\n| Setting | Recommended value | Why |\n| --- | --- | --- |\n| **Automatic Background Updates**  Forms > Settings | On, with a valid license key | Minor releases and patches install themselves; major versions stay manual. |\n| **From Email**  Form Settings > Notifications | An address on your site’s domain | The vendor asks for an address your server is authorized to send from, never the visitor’s. |\n| **Reply To**  Form Settings > Notifications | The email field’s merge tag, for example `{Email:2}` | You can reply to the visitor without spoofing their address as the sender. |\n| **Authenticated sending**  SMTP plugin or mail add-on | SMTP server or the Mailgun, Postmark or SendGrid add-on, with SPF and DKIM | Gravity Forms hands its email to `wp_mail()`: a plugin such as [WP Mail SMTP](https://www.wp-masquerade.com/features/camouflaged-plugins/wp-mail-smtp/) makes delivery reliable. |\n| **Honeypot**  Form Settings > Spam Detection | On, with suspicious submissions saved as spam | A [honeypot](https://www.wp-masquerade.com/glossary/honeypot/) does not bother visitors, and you can still review false positives. |\n| **Submission Speed Check**  Spam Detection | A moderate threshold, for example 2000 ms, Normal mode | Catches bots that submit too fast; check the Submission Speed column in Entries before tightening it. |\n| **Allowed file extensions**  File Upload field | Only the types you expect, such as `pdf`, plus a Maximum File Size | The vendor advises the most restrictive setting possible. |\n| **Require user to be logged in**  Form Settings > Restrictions | On for upload forms whenever possible | File uploads are then limited to authenticated users. |\n| **Retention Policy**  Form Settings > Personal Data | Automatic deletion after the period your privacy policy sets | Avoids piling up personal data; also check the option that prevents storing IP addresses if you do not need them. |\n\n- Submit a test entry and check that it appears under Entries and that the notification lands in the inbox.\n- Open Forms > System Status to check the license, versions and warnings.\n- Leave Enable access to the API turned off under Forms > Settings > REST API if no integration uses it.\n- On Nginx, have someone confirm that PHP cannot run in `wp-content/uploads/gravity_forms`: the `.htaccess` file the plugin creates only works on Apache.\n\nFor other protections against bots, see our page on [anti-spam for WordPress](https://www.wp-masquerade.com/wordpress-anti-spam/).\n\n## The file upload flaws that have hit Gravity Forms\n\nIn 2023, CVE-2023-28782, an unauthenticated [deserialization](https://www.wp-masquerade.com/glossary/insecure-deserialization/) of untrusted data, was fixed in version 2.7.4. Since late 2025, the serious flaws have mostly involved unauthenticated file uploads:\n\n- CVE-2025-12352, through the `copy_post_image` function, rated 9.8 by Wordfence, fixed in 2.9.21;\n- CVE-2026-19513, through a state and chunked upload hash confusion, rated 8.1, fixed in 3.0.3;\n- CVE-2026-84434, through a hidden file upload field, rated 9.8, fixed in 3.1.1.\n\nOn top of that, CVE-2026-103039, an unauthenticated PHP object injection through a post custom field, rated 9.8, was fixed in 3.1.3. Run at least that version, ideally the latest one. Urgent hotfixes do not always go through automatic updates, so watch the vendor’s announcements. Our guide to automatic plugin updates explains how to organize them.\n\nWP Masquerade Pro removes some of the traces that point bots to Gravity Forms (the next section lists which ones), which makes it harder to spot without replacing the patch.\n\n## Gravity Forms frequently asked questions\n\n**Is there a free version of Gravity Forms?**\n\nNo. The vendor offers neither a free version nor a trial, only an online demo. The Basic license, at $59 per year for one site, already includes every core feature.\n\n**Which license do I need to take payments?**\n\nThe Pro license, at $159 per year for three sites: it includes the Stripe, PayPal Checkout, Square and Mollie add-ons. The Basic license includes none of them.\n\n**Why didn’t version 3.0 install automatically?**\n\nMajor versions contain breaking changes and never install on their own. Test it on a copy of the site, then run the update from Plugins > Installed Plugins.\n\n**How do I delete old entries automatically?**\n\nUnder Form Settings > Personal Data, choose to move entries to the trash or delete them permanently after a number of days. The cleanup runs during WordPress’s daily scheduled task.\n\n## Key facts\n\n- Category: Forms\n- Vendor: Rocketgenius Inc.\n- Price: Paid: Basic license at $59 per year for one site, Pro at $159 for 3 sites, Elite at $259 for unlimited sites\n- Official page: https://www.gravityforms.com/\n\n## What WP Masquerade hides\n\n- Handled by WP Masquerade Pro only\n- With Pro: folder name, tag IDs\n- Still visible: JavaScript variables, CSS classes, REST routes",
    "catalog": "gravityforms",
    "essentials": [
        "Best for agencies building complex forms that need stored entries and conditional logic.",
        "Main caveat: no free version or trial, and payments or user registration require Pro or Elite.",
        "Paid: Basic is $59 per year for one site, Pro $159 for 3 sites, Elite $259 for unlimited sites."
    ],
    "format": "application/json"
}