Title: Form Marshal
Author: bpmore
Published: <strong>अक्टोबर 11, 2026</strong>
Last modified: अक्टोबर 28, 2026

---

प्लगिनहरू खोज्नुहोस्

![](https://ps.w.org/form-marshal/assets/banner-772x250.png?rev=3739946)

![](https://ps.w.org/form-marshal/assets/icon.svg?rev=3755106)

# Form Marshal

 [bpmore](https://profiles.wordpress.org/bpmore/) द्वारा

[डाउनलोड गर्नुहोस्](https://downloads.wordpress.org/plugin/form-marshal.0.8.0.zip)

 * [विवरण](https://ne.wordpress.org/plugins/form-marshal/#description)
 * [समीक्षाहरू](https://ne.wordpress.org/plugins/form-marshal/#reviews)
 *  [स्थापना](https://ne.wordpress.org/plugins/form-marshal/#installation)
 * [विकास](https://ne.wordpress.org/plugins/form-marshal/#developers)

 [सहायता](https://wordpress.org/support/plugin/form-marshal/)

## विवरण

Website forms are easy to build and easy to get wrong. A form that asks for a diagnosis,
a date of birth next to a name, or answers to a depression screening questionnaire
turns a website into a place that stores health information. Most form plugins store
every answer in the WordPress database, unencrypted, and none of them signs a business
associate agreement.

Form Marshal checks every form on the site and tells you which ones collect protected
health information (PHI) or personally identifiable information (PII), field by 
field, in plain sentences. In Block mode it turns off the forms that should not 
be running, on every page they appear on, and refuses their submissions, with a 
time-limited exception process for the cases that need one.

**Form Marshal is a control, not a compliance guarantee.** It flags likely problems
and gives administrators tools to act. It does not certify that a site meets HIPAA
or any other rule.

#### Works with

 * Gravity Forms
 * Ninja Forms
 * WPForms
 * Contact Form 7
 * Fluent Forms (and Fluent Forms Pro)
 * Forminator

#### Finds

 * **Every form, every field**: field types, labels, descriptions, placeholders,
   choices, hidden fields, the pages each form is placed on, and where answers go(
   emails, add-ons, redirects).
 * **Four classes**: clear, PII, PHI, and PHI (screening instrument), with a severity.
   Screening questionnaires such as PHQ-9 and GAD-7 count as PHI even without a 
   name field, because form plugins record the time and often the IP address with
   every answer.
 * **Stored answers, safely**: optional sampling of up to 100 stored entries per
   flagged form, checked for patterns such as Social Security numbers, dates of 
   birth, and health words. Only the pattern name and a count are kept, never the
   answer.

#### Blocks

 * **Block mode** replaces a flagged form wherever it appears with a short message
   and refuses its submissions before anything is stored, emailed, or sent on. Turn
   it on in the settings when you are ready. Flag mode, the default, only reports.
 * **Exceptions**: an editor asks for one with a reason; an administrator approves
   it for a limited time, with an optional retention limit for stored entries. Exceptions
   end on their own.
 * **Editor warnings** (all six form plugins): while a form is being built, a status
   box and notes under each field say what was found.

#### Reports and acts

 * A report of every form with its status, evidence, entries, where data goes, and
   the pages it appears on.
 * A page per form with findings by field, in plain sentences.
 * Stored entries: set a retention period, export to CSV and delete only exported
   entries, or mark as reviewed. New entries and drafts stay after export. Every
   action asks for confirmation and is recorded in an audit log.
 * An admin notice with your organization’s policy, with optional acknowledgment.
 * Email notices when a form becomes PHI or is blocked, and for exception requests.
 * WP-CLI commands for scanning, reporting, exceptions, and entries.
 * A policy filter (`form_marshal/policy`) so an organization can ship its own settings
   and lock them.

#### Form Marshal Pro

A separate paid add-on for organizations with many sites or auditors to answer: 
a compliance report to print, save as PDF, or download as Markdown, a network dashboard
and minimums for multisite, a daily digest email, a signed webhook, a monitoring
endpoint, and audit log export. Form Marshal itself is complete without it.

#### Privacy

 * Form Marshal never stores, logs, emails, or displays a form answer. Findings 
   hold field IDs, tags, and counts. A test checks that a seeded Social Security
   number appears nowhere after a scan.
 * It makes no requests to outside services and sends no usage data.
 * It deletes nothing on its own: retention changes, exports, and purges are administrator
   actions with a confirmation. Exports stream to the browser and are never written
   to the server.

## स्क्रिनसटहरू

[⌊The report: every form with its status, evidence, entries, and where its data 
goes.⌉⌊The report: every form with its status, evidence, entries, and where its 
data goes.⌉[

The report: every form with its status, evidence, entries, and where its data goes.

[⌊A form's page: findings by field, in plain sentences.⌉⌊A form's page: findings
by field, in plain sentences.⌉[

A form’s page: findings by field, in plain sentences.

[⌊Live warnings in the form editor.⌉⌊Live warnings in the form editor.⌉[

Live warnings in the form editor.

[⌊What a visitor sees in place of a blocked form.⌉⌊What a visitor sees in place 
of a blocked form.⌉[

What a visitor sees in place of a blocked form.

[⌊Settings, with values locked by an organization's policy pack.⌉⌊Settings, with
values locked by an organization's policy pack.⌉[

Settings, with values locked by an organization’s policy pack.

## स्थापना

 1. Install a supported form plugin: Gravity Forms 2.7 or newer, Ninja Forms, WPForms,
    Contact Form 7, Fluent Forms, or Forminator.
 2. Install and activate Form Marshal.
 3. Review the results. The default is **Flag**, so nothing is blocked yet. When you
    are ready, go to the settings and set enforcement to **Block**.
 4. Open **Forms > Form Marshal** (or **Tools > Form Marshal** if Gravity Forms is 
    not installed) and review the report.

On multisite, network-activate to cover every site.

## प्रश्नोत्तर

### Does Form Marshal make my site HIPAA compliant?

No. It is a control that finds and stops forms that are likely to collect health
information. Compliance depends on your whole organization, your agreements, and
your hosting.

### Will it turn off my forms?

Not unless you turn on Block mode. The default is Flag mode, which only reports.
In Block mode, forms it classifies as PHI are blocked. Personal-information forms
are reported but not blocked unless you choose to. Sites that used Form Marshal 
before 0.8.0 stay in Block mode after the update.

### Does it read the answers people submitted?

Only if entry sampling is on, and only to look for patterns. It keeps the pattern
name and a count, never the answer, and never stores, logs, or sends answers anywhere.

### Does it send data anywhere?

No. Form Marshal makes no outside requests.

### What happens to a blocked form’s page?

Visitors see a short message in place of the form. You can change the message, and
an organization’s policy pack can add a contact.

## समीक्षाहरू

यस प्लगिनको लागि कुनै समीक्षाहरू छैनन्।

## योगदानकर्ता र डेभलपरहरू

“Form Marshal” खुला स्रोत सफ्टवेयर हो। निम्न व्यक्तिहरूले यो प्लगिनमा योगदान गरेका
छन्।

योगदानकर्ताहरू

 *   [ bpmore ](https://profiles.wordpress.org/bpmore/)

[“Form Marshal” लाई आफ्नो भाषामा अनुवाद गर्नुहोस्](https://translate.wordpress.org/projects/wp-plugins/form-marshal)

### विकासमा रुचि छ?

[आरएसएस](https://plugins.trac.wordpress.org/log/form-marshal/?limit=100&mode=stop_on_copy&format=rss)
द्वारा [कोड ब्राउज गर्नुहोस्](https://plugins.trac.wordpress.org/browser/form-marshal/),
[एसभीएन रिपजिटरी](https://plugins.svn.wordpress.org/form-marshal/) हेर्नुहोस्, वा
[विकास लग](https://plugins.trac.wordpress.org/log/form-marshal/) को सदस्यता लिनुहोस्।

## चेन्जलग

#### 0.8.0

 * New installs start in Flag mode: forms are reported, and nothing is blocked until
   an administrator chooses Block.
 * Sites that used an earlier version keep Block as their default, so the update
   unblocks nothing. A mode you chose stays as chosen.
 * The mode menus start with a “Default” choice that shows what the site follows
   when it has no mode of its own.
 * On multisite, Form Marshal Pro can set a network default mode. Sites follow it
   unless they choose their own.

#### 0.7.0

Security fixes from two whole-plugin scans, plus the unreleased 0.6.3 and 0.6.4 
work.
 * Drafts and plugin storage posts no longer decide a form’s class or appear
under “Embedded on”. * Exceptions and dismissals end when a form’s fields, notifications,
confirmations, or logic change. Ones saved by earlier versions keep working until
they expire. * Approving an exception covers only the form version the approver 
saw. The `wp form-marshal exceptions approve` command now needs `--form-hash`. *
A full scan never lifts a block, and Gravity Forms editors see only Gravity Forms
forms. * Network sampling minimums hold, long submissions no longer stall scans,
and CLI exports are private from creation. * Export and purge deletes only the entries
included in a completed CSV. New entries and drafts are kept, and a failed or incomplete
export deletes nothing. * A failed scan keeps the last complete decision, and an
older scan cannot replace a newer one. * Network activation stays within its network.
Network deactivation clears plugin schedules across that network while keeping data.*
Adds fingerprints for Form Marshal Pro team reviews. They store no form text.

#### 0.6.2

 * The policy alert can always be hidden by each user: “I have read this” when acknowledgment
   is required, “Dismiss” otherwise. It returns when the message changes.
 * Security hardening: the message shown in place of a blocked form is escaped again
   after the `form_marshal/block_markup` filter, status badges are escaped where
   they are printed, and the report’s Filter button checks a nonce and the user’s
   permission.

#### 0.6.1

 * Ready for the WordPress.org Plugin Directory: passes Plugin Check with no errors,
   the plugin’s web address points to the public support page, and the plugin description
   no longer calls forms “non-compliant”.
 * Updated the translation template (it still listed strings that moved to Form 
   Marshal Pro).

#### 0.6.0

 * Added support for Fluent Forms (with Fluent Forms Pro) and Forminator: scanning,
   blocking, stored entries, and live editor warnings.

#### 0.5.0

 * Live warnings in the Ninja Forms, WPForms, and Contact Form 7 form editors.
 * The network dashboard and minimums, daily digest, webhook, monitoring endpoint,
   and audit log export move to Form Marshal Pro. Their settings carry over when
   Pro is added.
 * Fixed: `wp form-marshal entries purge --yes` never ran.
 * Fixed: a form’s pages could be missing from the report after pages were saved
   and forms scanned in the same run.

#### 0.4.0

 * Added support for Ninja Forms, WPForms, and Contact Form 7.

The full history is in CHANGELOG.md.

## मेटा

 *  संस्करण **0.8.0**
 *  पछिल्लो अपडेट **4 घण्टा अघि**
 *  सक्रिय स्थापना **१० भन्दा कम**
 *  वर्डप्रेस संस्करण ** 6.4 वा उच्च **
 *  जाँच गरिएको **7.1.4**
 *  PHP संस्करण ** 7.4 वा उच्च **
 *  भाषा
 * [English (US)](https://wordpress.org/plugins/form-marshal/)
 * ट्यागहरू
 * [compliance](https://ne.wordpress.org/plugins/tags/compliance/)[forms](https://ne.wordpress.org/plugins/tags/forms/)
   [gravity forms](https://ne.wordpress.org/plugins/tags/gravity-forms/)[HIPAA](https://ne.wordpress.org/plugins/tags/hipaa/)
   [privacy](https://ne.wordpress.org/plugins/tags/privacy/)
 *  [उन्नत दृश्य](https://ne.wordpress.org/plugins/form-marshal/advanced/)

## रेटिङ्गहरू

अहिलेसम्म कुनै समीक्षा पेस गरिएको छैन।

[तपाईँको समीक्षा](https://wordpress.org/support/plugin/form-marshal/reviews/#new-post)

[सबै समीक्षाहरू हेर्नुहोस्](https://wordpress.org/support/plugin/form-marshal/reviews/)

## योगदानकर्ताहरू

 *   [ bpmore ](https://profiles.wordpress.org/bpmore/)

## सहायता

केही भन्नु छ? सहयोग चाहियो?

 [सहायता फोरम हेर्नुहोस्](https://wordpress.org/support/plugin/form-marshal/)