Gravity Forms exports can contain uploaded-file values used by operations, support, and reporting teams. A raw storage path, durable public URL, copied signed token, or stale export can outlive the intended access window and expose files after a user or entry should no longer have access.
Use this for job applications, support attachments, identity documents, medical or legal intake, private uploads, offloaded storage, CSV exports, agency handoff, and retention workflows.
Quick answer
Create synthetic entries with harmless files across single and multi-file fields, renamed files, duplicate names, Unicode names, deleted entries, and expired records. Export through every approved path and classify each cell as a public URL, authenticated application route, signed object URL, raw storage path, or redacted value. Test logged-out, wrong-role, correct-role, copied-session, expired-token, deleted-user, deleted-entry, and post-retention access. The export should reveal no raw secret or internal path, and access should expire or revoke according to written policy.
Test scenarios to run
Run the same controlled fixture across these branches. Write down the expected result before testing so a surprising response is easy to identify.
| Scenario | Fixture | Expected result |
|---|
| Logged out | Fresh exported URL | Denied or bounded public policy |
| Authorized role | Fresh synthetic file | Allowed and logged |
| Expired token | Same URL after TTL | Denied |
| Deleted entry | Retained export | Access follows policy |
Diagnostic table
Use this table to connect the observed behavior to evidence and a verification step.
| Action | Evidence | Verification |
|---|
| Build harmless upload fixtures | Record Gravity Forms, storage and offload versions, file field settings, export method, user role, URL format, authentication layer, token lifetime, retention, backups, logging, and deletion owner. | Logged-out and wrong-role requests cannot fetch protected synthetic files. |
| Classify every exported URL | Create synthetic files with distinct harmless contents and names, then cover single, multi-file, replaced, renamed, Unicode, duplicate-name, deleted-entry, and retention-expired fixtures. | Authorized access works and produces a useful redacted audit event. |
| Test role, expiry, and revocation | Export through admin CSV, approved automation, reporting client, backup process, and any custom filter while recording exact cell type without publishing live tokens in logs. | Expired, revoked, and deleted fixtures deny access according to policy. |
| Redact paths and tokens | Request each exported URL logged out, with the wrong role, correct role, copied session, expired token, revoked user, deleted entry, and after object-storage retention. | Exports, backups, object storage, tickets, and reports share one retention map. |
What to check first
- Record Gravity Forms, storage and offload versions, file field settings, export method, user role, URL format, authentication layer, token lifetime, retention, backups, logging, and deletion owner.
- Create synthetic files with distinct harmless contents and names, then cover single, multi-file, replaced, renamed, Unicode, duplicate-name, deleted-entry, and retention-expired fixtures.
- Export through admin CSV, approved automation, reporting client, backup process, and any custom filter while recording exact cell type without publishing live tokens in logs.
- Request each exported URL logged out, with the wrong role, correct role, copied session, expired token, revoked user, deleted entry, and after object-storage retention.
- Replace raw or durable paths with an authenticated resolver or bounded signed URL, redact logs and reports, revoke old exports where possible, and document downstream deletion.
Field notes
- Write the pass condition before changing anything and keep one repeatable synthetic fixture for the full test window.
- Record exact versions and UTC timestamps because deployments, caches, retries, scheduled actions, and background jobs can change the evidence.
- Test the public path and the stored server-side result, not only an admin preview, isolated command, or API response.
- Repeat verification after the relevant cache, queue, cron, webhook, and observation window has completed.
Useful command or data shape
Adapt paths, IDs, and privacy handling to the site before running commands or storing data on production.
entry,field,url_class,logged_out,authorized,expired,deleted,retention,result
901,upload,app-route,deny,allow,deny,deny,30d,pass
902,files,signed-object,deny,allow,deny,deny,7d,pass
Why this usually happens
- An export writes the original file URL without the protection used by the admin download action.
- A signed object URL has an excessive lifetime and is copied into reports or tickets.
- Deleting an entry does not remove an offloaded object or downstream export.
- Logs record full query strings containing access tokens.
Decision rule
Approve an export only when it exposes no raw secret or internal path, grants the intended role for a bounded time, revokes as documented, and is deleted from every downstream copy on schedule.
Production verification checklist
- Logged-out and wrong-role requests cannot fetch protected synthetic files.
- Authorized access works and produces a useful redacted audit event.
- Expired, revoked, and deleted fixtures deny access according to policy.
- Exports, backups, object storage, tickets, and reports share one retention map.
Safe fix order
Use a sequence that makes each result easy to prove. Stop when new evidence changes the scope or owner of the problem.
- Build harmless upload fixtures
- Classify every exported URL
- Test role, expiry, and revocation
- Redact paths and tokens
- Reconcile retention downstream
Mistakes to avoid
- Changing production before recording exact versions, UTC timestamps, a stable fixture, the expected result, and a tested rollback point.
- Treating one successful screen as proof while stored records, logs, queues, caches, emails, APIs, and downstream systems remain unchecked.
- Testing only as an administrator instead of using the role, device, locale, cache state, and failure branch that real users reach.
- Leaving temporary exclusions, debug output, helper accounts, broad permissions, or one-off repair code active after verification.
Questions teams ask during testing
Can I run this directly in production?
Begin with read-only evidence and use staging for package, code, database, form, or permission changes. If a production canary is necessary, make it identifiable, reversible, monitored, and unable to expose personal data or charge a customer.
How do I avoid a false positive?
Repeat the same fixture with the same versions, role, URL, locale, cache state, and downstream integrations. Compare browser, stored, and log evidence instead of relying on one screen.
What should the evidence packet contain?
Keep UTC time, exact versions, synthetic record ID, expected result, actual result, relevant log lines, change made, rollback point, owner, and final verification. Redact secrets and personal data.
When is the test complete?
Close the work when the primary path passes, failure branches are understood, stored and downstream records reconcile, temporary changes are removed, and monitoring covers the next update.
What to tell the client or owner
Give the owner a concise packet with the affected workflow, exact versions, UTC test time, fixture ID, expected result, actual result, key logs, change made, rollback point, final result, unresolved risks, owner, and next review date. Remove credentials and personal data before sharing it.
When HandL WP should help
Bring in help when this affects leads, checkout, search visibility, security, paid media reporting, or a client production site. HandL WP can trace the issue through WordPress, hosting, cache, tracking, and Search Console, then verify the workflow after the technical fix.
If this is active on a production site, have HandL WP audit Gravity Forms file access.
Related HandL WP guides
Use these related guides when the same issue touches tracking, security, checkout, or crawler visibility.
Helpful references