Gravity Forms

PII is recorded information about an identifiable individual that is not otherwise available publicly. For example, PII includes, but is not limited to, Social Insurance Numbers (SIN), Passport Data, University Transcripts, Medical Records, and Student Numbers.

If you have forms on an Arts CMS or UBC CMS website that are currently collecting personally identifiable information, please edit or remove the form as soon as possible.

Alternative options

UBC IT has approved Qualtrics as a BC FIPPA-compliant tool, which can be used to collect sensitive data. Additionally, forms on Arts Internal Resources (AIR) can be used as a secure alternative, including forms that are used for online payments (i.e., UBC Digital Payments).

reCAPTCHA protects your website from fraud and deters spam from being submitted via your web forms.

Step 1: Enable reCAPTCHA from Google

1. Go to https://www.google.com/recaptcha/admin/
2. Login with the unit’s Google Account. This may be an account your unit already use for Google Analytics. (Note: It is best to use a generic account than a personal one, since staff may leave the department and take access with them)
3. Click the “+” icon in the top right corner
4. Create a descriptive label for this site key
5. Select one of the following based on the website server:
   • CAPTCHA v2: for Arts CMS and Arts Internal Resource (AIR) sites
   • CAPTCHA v3: for UBC CMS sites
     (Note: to check, go to your site's Dashboard and look at the back-end URL. Arts CMS: .cms.arts.ubc.ca, AIR: .air.arts.ubc.ca, UBC CMS: .sites.olt.ubc.ca)
6. Add the front-facing AND back-end domains (e.g. artf.cms.arts.ubc.ca AND arts.ubc.ca)
7. Submit the request

Step 2: Add reCAPTCHA to WordPress Gravity Forms

Arts CMS and Arts Internal Resource (AIR):

1. Log into your website Dashboard
2. Go to Forms > Settings > reCAPTCHA Settings.
3. Enter the private and public keys. You should see an example CAPTCHA field pop-up to confirm the keys have been properly attached.
4. Edit the form
5. Open the “Advanced Fields” box on the right-hand side.
6. Drag the “CAPTCHA” field into the form.
7. Update the form to save your changes.

UBC CMS:

1. Log into your website Dashboard
2. Go to Plugins
3. Search for "Gravity Forms reCAPTCHA Add-On"
4. Click Activate
5. Go to Forms > Settings > reCAPTCHA Settings.
6. Under the "reCAPTCHA v3" section, enter the private and public keys. You should see an example CAPTCHA field pop-up to confirm the keys have been properly attached.

With reCAPTCHA v3, it runs checks in the background so you do not need to add the field into your forms. It's automatically applied to all forms on your website.

Additional options for reducing spam

In addition to reCAPTCHA, Gravity Forms also has Anti-spam honeypot, which is an alternative to the reCAPTCHA field. To further reduce the likelihood of receiving spam submissions, it is encouraged to make use of both of these features. Anti-spam honeypot can be enabled for each form under Form Settings > Enable Anti-spam honeypot.

Troubleshooting

Problem: The form I created has a ReCAPTCHA field that has an error message that states, “Error: Invalid domain for site key”

Solution: The front-facing and/or the back-end domains have not been added to the list of domains on the Google Account. Please follow the process outlined in “Step 1: Enable reCAPTCHA from Google” above and perform item #6 of the process. If you are unsure of what the back-end domain of the site is, please log into your site’s dashboard. The address bar will show the back-end domain as the site address, before the /wp-admin slug. For example, arts.ubc.ca is the front-facing domain and artf.cms.arts.ubc.ca is the back-end domain of the same site.