Form Marshal

Description

Website forms are easy to build and easy to get wrong. A form that asks for a diagnosis, a date of birth next to a name, or answers to a depression screening questionnaire turns a website into a place that stores health information. Most form plugins store every answer in the WordPress database, unencrypted, and none of them signs a business associate agreement.

Form Marshal checks every form on the site and tells you which ones collect protected health information (PHI) or personally identifiable information (PII), field by field, in plain sentences. In Block mode it turns off the forms that should not be running, on every page they appear on, and refuses their submissions, with a time-limited exception process for the cases that need one.

Form Marshal is a control, not a compliance guarantee. It flags likely problems and gives administrators tools to act. It does not certify that a site meets HIPAA or any other rule.

Works with

• Gravity Forms
• Ninja Forms
• WPForms
• Contact Form 7
• Fluent Forms (and Fluent Forms Pro)
• Forminator

Finds

• Every form, every field: field types, labels, descriptions, placeholders, choices, hidden fields, the pages each form is placed on, and where answers go (emails, add-ons, redirects).
• Four classes: clear, PII, PHI, and PHI (screening instrument), with a severity. Screening questionnaires such as PHQ-9 and GAD-7 count as PHI even without a name field, because form plugins record the time and often the IP address with every answer.
• Stored answers, safely: optional sampling of up to 100 stored entries per flagged form, checked for patterns such as Social Security numbers, dates of birth, and health words. Only the pattern name and a count are kept, never the answer.

Blocks

• Block mode replaces a flagged form wherever it appears with a short message and refuses its submissions before anything is stored, emailed, or sent on. Flag mode only reports.
• Exceptions: an editor asks for one with a reason; an administrator approves it for a limited time, with an optional retention limit for stored entries. Exceptions end on their own.
• Editor warnings (all six form plugins): while a form is being built, a status box and notes under each field say what was found.

Reports and acts

• A report of every form with its status, evidence, entries, where data goes, and the pages it appears on.
• A page per form with findings by field, in plain sentences.
• Stored entries: set a retention period, export to CSV and delete only exported entries, or mark as reviewed. New entries and drafts stay after export. Every action asks for confirmation and is recorded in an audit log.
• An admin notice with your organization’s policy, with optional acknowledgment.
• Email notices when a form becomes PHI or is blocked, and for exception requests.
• WP-CLI commands for scanning, reporting, exceptions, and entries.
• A policy filter (form_marshal/policy) so an organization can ship its own settings and lock them.

Form Marshal Pro

A separate paid add-on for organizations with many sites or auditors to answer: a compliance report to print, save as PDF, or download as Markdown, a network dashboard and minimums for multisite, a daily digest email, a signed webhook, a monitoring endpoint, and audit log export. Form Marshal itself is complete without it.

Privacy

• Form Marshal never stores, logs, emails, or displays a form answer. Findings hold field IDs, tags, and counts. A test checks that a seeded Social Security number appears nowhere after a scan.
• It makes no requests to outside services and sends no usage data.
• It deletes nothing on its own: retention changes, exports, and purges are administrator actions with a confirmation. Exports stream to the browser and are never written to the server.