PHP Hooks and Filters Reference
Applies to: Elzo Forms Free and Elzo Forms Pro where noted.
Audience: Developers extending Elzo Forms with WordPress actions, filters, modules, templates, submissions, and PRO automations.
This page lists the main PHP actions and filters available in Elzo Forms. Use these hooks when you need to validate submissions, detect spam, customize saved data, modify email settings, change AJAX responses, register modules, customize templates, or extend PRO automations.
This is a developer reference. If you are looking for task-based examples, see the related developer guides for custom fields, modules, template overrides, JavaScript events, and custom automation actions.
How Elzo Forms processes a submission
Most submission-related hooks run in this order:
- The form submission request is received.
- Nonce, form ID, form object, timing, and IP checks are validated.
elzo_forms_validate_submissionruns for custom server-side validation.elzo_forms_detect_spamruns for custom spam detection.- Submitted fields are matched against visible form fields.
elzo_forms_is_field_value_emptyruns for required-field empty checks.- Field classes validate and sanitize field values.
- The submission is saved.
elzo_forms_after_submission_savedruns for non-spam submissions.- Enabled modules handle the submission.
elzo_forms_submission_email_settingsruns before the built-in email notification is sent.elzo_forms_submission_responseruns before the final AJAX success response is returned.
Important: use the earliest hook that matches your goal. For example, use elzo_forms_validate_submission to block a submission, elzo_forms_after_submission_saved to run logic after saving, and elzo_forms_submission_response to customize the frontend success response.
Quick reference
| Hook | Type | Scope | Use it to |
|---|---|---|---|
elzo_forms_validate_submission |
Filter | Free | Run custom server-side validation before field processing continues. |
elzo_forms_detect_spam |
Filter | Free | Mark a submission as spam using custom rules. |
elzo_forms_is_field_value_empty |
Filter | Free | Customize how Elzo Forms decides whether a required field is empty. |
elzo_forms_after_submission_saved |
Action | Free | Run custom logic after a valid non-spam submission is saved. |
elzo_forms_submission_email_settings |
Filter | Free | Change built-in email notification settings at runtime. |
elzo_forms_submission_response |
Filter | Free | Customize the AJAX success response returned to the frontend. |
elzo_forms_field_types |
Filter | Free | Register or modify available field types. |
elzo_forms_field |
Filter | Free | Modify field data before rendering. |
elzo_forms_form_data_attributes |
Filter | Free | Add custom HTML data attributes to the rendered form element. |
elzo_forms/templates/* |
Action / Filter | Free | Customize template loading, template arguments, and before/after template output. |
elzo_forms/modules/register |
Action | Free | Register a custom module with the module manager. |
elzo_forms_pro_automation_actions |
Filter | Pro | Register custom automation action classes. |
elzo_forms_pro_automation_conditions |
Filter | Pro | Register custom automation condition classes. |
elzo_forms_pro_automation_before_action |
Action | Pro | Run logic immediately before an automation action executes. |
elzo_forms_pro_automation_after_action |
Action | Pro | Inspect or react to an automation action result. |
Submission hooks
elzo_forms_validate_submission
Type: Filter
Scope: Free
Runs: after the form object and timing checks are prepared, before submitted fields are processed.
Use this to: block a submission with custom server-side validation.
Signature:
add_filter( 'elzo_forms_validate_submission', function( $result, $form, $context ) {
return $result;
}, 10, 3 );
Parameters:
$result— default validation result. Usuallytrue.$form— current\ElzoForms\Form\Forminstance.$context— array with request timing data, includingsubmission_timeandform_load_time.
Return: return the current result to continue, or return a WP_Error to stop the submission and show an error message.
Example: block submissions outside business hours.
<?php
add_filter( 'elzo_forms_validate_submission', function( $result, $form, $context ) {
$hour = (int) current_time( 'G' );
if ( $hour < 9 || $hour >= 18 ) {
return new WP_Error(
'elzo_forms_closed',
__( 'This form is available only during business hours.', 'my-plugin' )
);
}
return $result;
}, 10, 3 );
Note: do not return false expecting the submission to stop. To block processing, return a WP_Error.
elzo_forms_detect_spam
Type: Filter
Scope: Free
Runs: before submitted fields are processed and before the submission is saved.
Use this to: mark a submission as spam based on custom rules.
Signature:
add_filter( 'elzo_forms_detect_spam', function( $is_spam, $form, $context ) {
return $is_spam;
}, 10, 3 );
Parameters:
$is_spam— current spam status as boolean.$form— current\ElzoForms\Form\Forminstance.$context— array with timing data.
Return: boolean. Return true to mark the submission as spam.
Example: mark submissions from a suspicious query string as spam.
<?php
add_filter( 'elzo_forms_detect_spam', function( $is_spam, $form, $context ) {
if ( isset( $_GET['traffic_source'] ) && $_GET['traffic_source'] === 'bad-campaign' ) {
return true;
}
return $is_spam;
}, 10, 3 );
elzo_forms_is_field_value_empty
Type: Filter
Scope: Free
Runs: when Elzo Forms checks whether a visible required field is empty.
Use this to: customize empty-value detection for special field values.
Signature:
add_filter( 'elzo_forms_is_field_value_empty', function( $is_empty, $value, $field, $form ) {
return $is_empty;
}, 10, 4 );
Parameters:
$is_empty— current empty check result.$value— submitted field value.$field— current field object.$form— current form object.
Return: boolean. Return true when the value should be treated as empty.
Example: treat a placeholder option value as empty.
<?php
add_filter( 'elzo_forms_is_field_value_empty', function( $is_empty, $value, $field, $form ) {
if ( $value === 'please-select' ) {
return true;
}
return $is_empty;
}, 10, 4 );
elzo_forms_after_submission_saved
Type: Action
Scope: Free
Runs: after a valid non-spam submission is saved, before built-in email settings are applied and before the final response is sent.
Use this to: send data to external services, create posts, update metadata, or trigger custom business logic after a successful submission.
Signature:
add_action( 'elzo_forms_after_submission_saved', function( $form, $submission, $submission_post_id ) {
// Your logic here.
}, 10, 3 );
Parameters:
$form— current\ElzoForms\Form\Forminstance.$submission— current\ElzoForms\Submission\Submissioninstance.$submission_post_id— saved submission post ID.
Example: store a custom meta flag on every saved submission.
<?php
add_action( 'elzo_forms_after_submission_saved', function( $form, $submission, $submission_post_id ) {
update_post_meta( $submission_post_id, '_sent_to_custom_integration', 'no' );
}, 10, 3 );
Example: read submitted fields.
<?php
add_action( 'elzo_forms_after_submission_saved', function( $form, $submission, $submission_post_id ) {
$fields = $submission->get_fields();
foreach ( $fields as $field ) {
$field_id = $field['id'] ?? '';
$value = $field['value'] ?? '';
// Use $field_id and $value here.
}
}, 10, 3 );
elzo_forms_submission_email_settings
Type: Filter
Scope: Free
Runs: before the built-in email notification is sent.
Use this to: enable, disable, or change built-in notification recipients at runtime.
Signature:
add_filter( 'elzo_forms_submission_email_settings', function( $email_settings, $form, $submission, $submission_post_id ) {
return $email_settings;
}, 10, 4 );
Parameters:
$email_settings— array of email notification settings.$form— current form object.$submission— current submission object.$submission_post_id— saved submission post ID.
Return: modified email settings array.
Common keys:
email_notifications—yesorno.email_notification_recipients— comma-separated string, newline-separated string, or array of email addresses.
Example: send notifications for a specific form to a different recipient.
<?php
add_filter( 'elzo_forms_submission_email_settings', function( $email_settings, $form, $submission, $submission_post_id ) {
if ( method_exists( $form, 'get_slug' ) && $form->get_slug() === 'partner-request' ) {
$email_settings['email_notifications'] = 'yes';
$email_settings['email_notification_recipients'] = 'partners@example.com';
}
return $email_settings;
}, 10, 4 );
elzo_forms_submission_response
Type: Filter
Scope: Free
Runs: after submission processing, before the AJAX success response is returned.
Use this to: add custom response data, adjust redirects, or pass custom data to frontend scripts.
Signature:
add_filter( 'elzo_forms_submission_response', function( $response, $submission, $form ) {
return $response;
}, 10, 3 );
Parameters:
$response— response array.$submission— current submission object.$form— current form object.
Default response keys:
messageredirect_urlredirect_delaysubmission_post_id
Example: add a custom tracking value to the AJAX response.
<?php
add_filter( 'elzo_forms_submission_response', function( $response, $submission, $form ) {
$response['tracking_event'] = 'elzo_form_submission';
$response['form_id'] = method_exists( $form, 'get_id' ) ? $form->get_id() : null;
return $response;
}, 10, 3 );
Field and form rendering hooks
elzo_forms_field_types
Type: Filter
Scope: Free
Runs: when Elzo Forms builds the list of available field types.
Use this to: add or modify field type definitions.
Signature:
add_filter( 'elzo_forms_field_types', function( $types ) {
return $types;
} );
Return: array of field type definitions. Each field type should include a human-readable label and a PHP class name in class.
Example: register a custom field type.
<?php
add_filter( 'elzo_forms_field_types', function( $types ) {
$types['rating'] = [
'label' => __( 'Rating', 'my-plugin' ),
'class' => \MyPlugin\ElzoForms\Fields\Rating_Field::class,
];
return $types;
} );
elzo_forms_field_text_subtypes
Type: Filter
Scope: Free
Use this to: add or modify subtypes for the Text field.
<?php
add_filter( 'elzo_forms_field_text_subtypes', function( $subtypes ) {
$subtypes['url'] = __( 'URL', 'my-plugin' );
return $subtypes;
} );
elzo_forms_field_widths
Type: Filter
Scope: Free
Use this to: add or modify field width options in the admin UI.
<?php
add_filter( 'elzo_forms_field_widths', function( $widths ) {
$widths['2/3'] = __( 'Two thirds (2/3)', 'my-plugin' );
return $widths;
} );
elzo_forms_field
Type: Filter
Scope: Free
Runs: when field data is prepared from a field object.
Use this to: modify field data before rendering.
Signature:
add_filter( 'elzo_forms_field', function( $field_data, $field ) {
return $field_data;
}, 10, 2 );
Example: add a custom class to a specific field key.
<?php
add_filter( 'elzo_forms_field', function( $field_data, $field ) {
if ( isset( $field_data['field_key'] ) && $field_data['field_key'] === 'company_email' ) {
$field_data['custom_class'] = trim( ( $field_data['custom_class'] ?? '' ) . ' is-company-email' );
}
return $field_data;
}, 10, 2 );
elzo_forms_form_data_attributes
Type: Filter
Scope: Free
Runs: when the form HTML attributes are prepared.
Use this to: add custom data-* attributes to the form wrapper.
Signature:
add_filter( 'elzo_forms_form_data_attributes', function( $attributes, $form_id ) {
return $attributes;
}, 10, 2 );
Example: expose a custom integration flag to frontend scripts.
<?php
add_filter( 'elzo_forms_form_data_attributes', function( $attributes, $form_id ) {
$attributes['data-my-integration-enabled'] = '1';
return $attributes;
}, 10, 2 );
elzo_forms_handle_phone_field
Type: Filter
Scope: Free
Runs: when a telephone text field is sanitized.
Use this to: normalize telephone values before they are stored.
<?php
add_filter( 'elzo_forms_handle_phone_field', function( $phone, $field_data ) {
return preg_replace( '/[^\d+]/', '', $phone );
}, 10, 2 );
Settings and saved form data hooks
elzo_forms_default_settings
Type: Filter
Scope: Free
Use this to: add or modify default form settings.
<?php
add_filter( 'elzo_forms_default_settings', function( $settings ) {
$settings['my_custom_setting'] = '';
return $settings;
} );
elzo_forms_form_settings
Type: Filter
Scope: Free
Runs: after global, default, and form-specific settings are merged.
Use this to: modify runtime form settings.
<?php
add_filter( 'elzo_forms_form_settings', function( $settings, $form_post ) {
if ( $form_post instanceof WP_Post && $form_post->post_name === 'contact-us' ) {
$settings['min_submission_delay'] = 3;
}
return $settings;
}, 10, 2 );
elzo_forms_form_styles
Type: Filter
Scope: Free
Use this to: modify runtime form style settings.
<?php
add_filter( 'elzo_forms_form_styles', function( $styles, $form_post ) {
$styles['primary_color'] = '#1d4ed8';
return $styles;
}, 10, 2 );
elzo_forms_form_texts
Type: Filter
Scope: Free
Use this to: modify runtime form text values.
<?php
add_filter( 'elzo_forms_form_texts', function( $texts, $form_post ) {
$texts['success_submit_message'] = __( 'Thank you. We received your message.', 'my-plugin' );
return $texts;
}, 10, 2 );
elzo_forms_form_data_before_save
Type: Filter
Scope: Free / Pro
Runs: before the form builder JSON data is saved to the form post content.
Use this to: add extension data to the saved form JSON payload.
Signature:
add_filter( 'elzo_forms_form_data_before_save', function( $data, $post_id, $raw_post ) {
return $data;
}, 10, 3 );
Example: persist custom builder data.
<?php
add_filter( 'elzo_forms_form_data_before_save', function( $data, $post_id, $raw_post ) {
if ( isset( $raw_post['my_plugin_form_meta'] ) ) {
$data['my_plugin'] = [
'meta' => sanitize_text_field( wp_unslash( $raw_post['my_plugin_form_meta'] ) ),
];
}
return $data;
}, 10, 3 );
Important: only store data you own under a unique top-level key to avoid conflicts with Elzo Forms core data.
Admin save filters
These filters are useful when extending the form builder or normalizing saved form configuration.
| Hook | Type | Arguments | Use it to |
|---|---|---|---|
elzo_forms_field_before_save |
Filter | $field |
Modify a field array before it is stored. |
elzo_forms_step_before_save |
Filter | $step |
Modify a step array before it is stored. |
elzo_forms_form_settings_value_before_save |
Filter | $value, $key |
Modify any form setting value before saving. |
elzo_forms_form_settings_{$key}_before_save |
Filter | $value |
Modify one specific form setting before saving. |
elzo_forms_form_texts_value_before_save |
Filter | $value, $key |
Modify any form text value before saving. |
elzo_forms_form_texts_{$key}_before_save |
Filter | $value |
Modify one specific form text before saving. |
elzo_forms_json_encoding_error |
Action | $exception, $post_id |
Handle JSON encoding failures while saving a form. |
Template hooks
Elzo Forms supports WooCommerce-style template overrides and template-loading hooks.
elzo_forms/templates/theme_dir
Type: Filter
Scope: Free
Use this to: change the theme directory where Elzo Forms looks for overridden templates.
<?php
add_filter( 'elzo_forms/templates/theme_dir', function( $dir ) {
return 'my-theme/elzo-forms';
} );
elzo_forms/templates/locate_template
Type: Filter
Scope: Free
Use this to: override the located template path programmatically.
<?php
add_filter( 'elzo_forms/templates/locate_template', function( $template, $template_name, $template_path, $args ) {
if ( $template_name === 'form.php' ) {
$custom_template = plugin_dir_path( __FILE__ ) . 'templates/elzo-form.php';
if ( file_exists( $custom_template ) ) {
return $custom_template;
}
}
return $template;
}, 10, 4 );
elzo_forms/templates/template_args
Type: Filter
Scope: Free
Use this to: add or modify variables available inside frontend templates.
<?php
add_filter( 'elzo_forms/templates/template_args', function( $args, $template_name, $template ) {
if ( $template_name === 'form.php' ) {
$args['my_custom_value'] = 'Example value';
}
return $args;
}, 10, 3 );
elzo_forms/templates/before_template and elzo_forms/templates/after_template
Type: Action
Scope: Free
Use this to: output or run logic before or after a frontend template is loaded.
<?php
add_action( 'elzo_forms/templates/before_template', function( $template_name, $template_path, $template, $args ) {
if ( $template_name === 'form.php' ) {
echo '<div class="my-elzo-form-wrapper">';
}
}, 10, 4 );
add_action( 'elzo_forms/templates/after_template', function( $template_name, $template_path, $template, $args ) {
if ( $template_name === 'form.php' ) {
echo '</div>';
}
}, 10, 4 );
Module hooks
elzo_forms/modules/register
Type: Action
Scope: Free
Runs: after the core module manager is created and the core modules are registered.
Use this to: register custom modules.
Signature:
add_action( 'elzo_forms/modules/register', function( $manager ) {
// $manager->register( new Your_Module() );
} );
Example:
<?php
add_action( 'elzo_forms/modules/register', function( $manager ) {
if ( class_exists( \MyPlugin\ElzoForms\Modules\My_Module::class ) ) {
$manager->register( new \MyPlugin\ElzoForms\Modules\My_Module() );
}
} );
elzo_forms/modules/enabled
Type: Filter
Scope: Free
Use this to: modify the list of enabled modules for a specific form.
<?php
add_filter( 'elzo_forms/modules/enabled', function( $enabled, $form_id ) {
if ( (int) $form_id === 123 ) {
$enabled[] = 'my_module';
}
return array_values( array_unique( $enabled ) );
}, 10, 2 );
elzo_forms/module/{$id}/settings
Type: Filter
Scope: Free
Use this to: modify a specific module settings array for one form.
<?php
add_filter( 'elzo_forms/module/my_module/settings', function( $settings, $form_id ) {
$settings['enabled_for_custom_flow'] = true;
return $settings;
}, 10, 2 );
JSON storage hooks
Use these hooks when integrating with JSON-based form sync, deployment workflows, or custom import/export tools.
| Hook | Type | Arguments | Use it to |
|---|---|---|---|
elzo_forms/json_storage/init |
Action | None | Run logic when JSON storage is initialized. |
elzo_forms/load_form_data |
Filter | $data, $post |
Modify loaded form data, including JSON-file-backed data. |
elzo_forms/json_storage/prepare_data |
Filter | $form_data, $post |
Modify form data before JSON export. |
elzo_forms/json_storage/import_form_payload |
Filter | $payload, $form_data, $filepath |
Sanitize or modify imported form payload data. |
Example: remove environment-specific data from JSON export.
<?php
add_filter( 'elzo_forms/json_storage/prepare_data', function( $form_data, $post ) {
if ( isset( $form_data['data']['my_plugin']['local_secret'] ) ) {
unset( $form_data['data']['my_plugin']['local_secret'] );
}
return $form_data;
}, 10, 2 );
Submission admin table hooks
These hooks customize the WordPress admin submission list table.
| Hook | Type | Arguments | Use it to |
|---|---|---|---|
elzo_forms_submission_table_field_labels |
Filter | $field_labels, $submission_fields |
Modify dynamic field column labels. |
elzo_forms_submission_table_field |
Filter | $field, $column, $submission_data |
Modify the value used for a submission table field column. |
elzo_forms_submission_table_form_title |
Filter | $form_title, $form_id |
Modify the displayed form title in the submissions table. |
elzo_forms_submission_table_form_edit_url |
Filter | $form_edit_url, $form_id |
Modify the form edit URL in the submissions table. |
elzo_forms_submission_form_dropdown_options |
Filter | $forms |
Modify form options in the submission filter dropdown. |
Email template hooks
elzo_forms_admin_email_field
Type: Filter
Scope: Free
Runs: while preparing fields for the built-in admin email template.
Use this to: modify how a submitted field appears in the admin notification email.
<?php
add_filter( 'elzo_forms_admin_email_field', function( $field ) {
if ( isset( $field['value'] ) && is_array( $field['value'] ) ) {
$field['value'] = implode( ', ', $field['value'] );
}
return $field;
} );
File upload hooks
elzo_forms_dangerous_extensions
Type: Filter
Scope: Free
Runs: during upload validation.
Use this to: add more extensions to the blocked file extension list.
Default blocked extensions include: php, php3, php4, php5, phtml, and phar.
<?php
add_filter( 'elzo_forms_dangerous_extensions', function( $extensions ) {
$extensions[] = 'sh';
$extensions[] = 'exe';
return array_values( array_unique( $extensions ) );
} );
Security note: do not remove PHP-related extensions from this list on public websites.
Pro automation hooks
The following hooks are available in Elzo Forms Pro and are designed for extending automation workflows.
elzo_forms_pro_automation_actions
Type: Filter
Scope: Pro
Runs: when the PRO automation action registry is built.
Use this to: register custom automation action classes.
Each class must implement \ElzoFormsPro\Automation\Actions\ActionInterface.
Signature:
add_filter( 'elzo_forms_pro_automation_actions', function( $action_classes ) {
return $action_classes;
} );
Example: register a custom automation action.
<?php
add_filter( 'elzo_forms_pro_automation_actions', function( $action_classes ) {
$action_classes[] = \MyPlugin\ElzoForms\Automation\Actions\CreateLeadAction::class;
return $action_classes;
} );
Action class contract:
<?php
namespace MyPlugin\ElzoForms\Automation\Actions;
use ElzoFormsPro\Automation\Actions\ActionInterface;
class CreateLeadAction implements ActionInterface {
public function get_type(): string {
return 'my_create_lead';
}
public function get_label(): string {
return __( 'Create lead', 'my-plugin' );
}
public function get_settings_schema(): array {
return [
'api_key' => [ 'type' => 'text' ],
];
}
public function execute( array $settings, array $context ): array {
// Use $context['fields_by_key'], $context['form'], $context['submission'], etc.
return [
'success' => true,
'message' => __( 'Lead created.', 'my-plugin' ),
];
}
}
elzo_forms_pro_automation_conditions
Type: Filter
Scope: Pro
Runs: when the PRO automation condition registry is built.
Use this to: register custom automation condition classes.
Each class must implement \ElzoFormsPro\Automation\Conditions\ConditionInterface.
<?php
add_filter( 'elzo_forms_pro_automation_conditions', function( $condition_classes ) {
$condition_classes[] = \MyPlugin\ElzoForms\Automation\Conditions\BusinessHoursCondition::class;
return $condition_classes;
} );
Condition class contract:
<?php
namespace MyPlugin\ElzoForms\Automation\Conditions;
use ElzoFormsPro\Automation\Conditions\ConditionInterface;
class BusinessHoursCondition implements ConditionInterface {
public function get_type(): string {
return 'business_hours';
}
public function get_label(): string {
return __( 'Business hours', 'my-plugin' );
}
public function get_operators(): array {
return [ 'is', 'is_not' ];
}
public function evaluate( array $condition, array $context ): bool {
$hour = (int) current_time( 'G' );
$is_open = $hour >= 9 && $hour < 18;
$operator = $condition['operator'] ?? 'is';
return $operator === 'is_not' ? ! $is_open : $is_open;
}
}
Automation lifecycle actions
| Hook | Type | Arguments | Runs |
|---|---|---|---|
elzo_forms_pro_automation_before_rule |
Action | $rule, $context |
Before an automation rule is evaluated. |
elzo_forms_pro_automation_after_rule |
Action | $rule, $context, $rule_result |
After a rule is evaluated and its actions have run if matched. |
elzo_forms_pro_automation_before_action |
Action | $rule, $action_payload, $context |
Immediately before an enabled automation action executes. |
elzo_forms_pro_automation_after_action |
Action | $rule, $action_payload, $context, $action_result |
Immediately after an automation action executes. |
Example: log failed automation actions to PHP error log.
<?php
add_action( 'elzo_forms_pro_automation_after_action', function( $rule, $action_payload, $context, $action_result ) {
$success = $action_result['success'] ?? null;
$status = $action_result['status'] ?? null;
if ( $success === false || $status === 'failed' ) {
error_log( 'Elzo Forms automation action failed: ' . wp_json_encode( [
'rule' => $rule['title'] ?? '',
'action' => $action_payload['type'] ?? '',
'result' => $action_result,
] ) );
}
}, 10, 4 );
Automation context
Custom automation actions and conditions receive a $context array. The most important keys are:
| Context key | Type | Description |
|---|---|---|
form |
\ElzoForms\Form\Form |
Current form object. |
submission |
\ElzoForms\Submission\Submission |
Current submission object. |
fields_by_id |
array | Submitted field values keyed by field ID. |
fields_by_key |
array | Submitted field values keyed by field key when available. |
field_items |
array | Full submitted field item arrays. |
request |
array | Request data. |
server |
array | Server data. |
cookies |
array | Cookie data. |
user |
WP_User |
Current WordPress user. |
current_url |
string | Detected current URL. |
current_page_id |
int|null | Current queried page ID when available. |
current_post_type |
string|null | Current post type when available. |
extra |
array | Extra runtime context, such as submission_post_id. |
Custom automation actions may return context_patch to update the context for later actions, or response_patch to modify the final frontend response.
<?php
return [
'success' => true,
'message' => __( 'Action complete.', 'my-plugin' ),
'context_patch' => [
'fields_by_id' => [
'lead_status' => 'qualified',
],
],
'response_patch' => [
'redirect_url' => home_url( '/thank-you/' ),
],
];
Automation log filters
Use these filters to control what is stored in automation logs.
| Hook | Type | Arguments | Use it to |
|---|---|---|---|
elzo_forms_pro_automation_log_filter_details |
Filter | $details, $action_type |
Modify action log details before sensitive-field masking is applied. |
elzo_forms_pro_automation_log_sensitive_fields |
Filter | $sensitive_fields, $action_type |
Customize which action result fields are redacted in logs. |
Example: redact an API token from a custom action log.
<?php
add_filter( 'elzo_forms_pro_automation_log_sensitive_fields', function( $sensitive_fields, $action_type ) {
$sensitive_fields['my_create_lead'][] = 'api_token';
return $sensitive_fields;
}, 10, 2 );
Advanced admin hooks
These hooks are mostly useful for admin integrations, custom dashboards, or site-specific tooling.
| Hook | Type | Use it to |
|---|---|---|
elzo_forms_settings_sanitization_rules |
Filter | Modify sanitization rules for an option. |
elzo_forms_settings_sanitization_rules_{$option_name} |
Filter | Modify sanitization rules for one specific option. |
elzo_forms_settings_default_sanitization_rule |
Filter | Change the fallback sanitization rule. |
elzo_forms_get_update_metadata |
Filter | Provide update metadata in custom update flows. |
elzo_forms_logic_label_max_length |
Filter | Change the maximum displayed logic label length in the admin UI. |
elzo_forms_custom_form_label |
Filter | Display a label for custom or non-numeric form references. |
elzo_forms_custom_form_edit_url |
Filter | Display an edit URL for custom or non-numeric form references. |
elzo_forms_admin_submission_field |
Filter | Modify fields shown in the admin submission view. |
elzo_forms_admin_field |
Filter | Modify admin field data before rendering in the builder. |
elzo_forms_admin_field_tabs |
Filter | Add or modify field settings tabs in the admin UI. |
elzo_forms_alert_types |
Filter | Add or modify available alert types. |
Security guidelines
When using Elzo Forms hooks, follow standard WordPress security practices:
- Sanitize all data coming from
$_POST,$_GET,$_REQUEST, cookies, headers, and external APIs. - Escape all output with the correct escaping function, such as
esc_html(),esc_attr(), oresc_url(). - Use
current_user_can()before changing admin-only data or privileged settings. - Do not store API keys, passwords, access tokens, or secrets inside public form data.
- Do not remove dangerous upload extensions unless you fully control the upload environment.
- Use
WP_Errorfor validation failures that should be shown to the user. - Keep custom automation logs free of sensitive data.
Choosing the right hook
| Goal | Recommended hook |
|---|---|
| Block a submission with a custom error message | elzo_forms_validate_submission |
| Mark a submission as spam | elzo_forms_detect_spam |
| Run logic after a valid submission is saved | elzo_forms_after_submission_saved |
| Change notification recipients dynamically | elzo_forms_submission_email_settings |
| Change the frontend success response | elzo_forms_submission_response |
| Add a custom field type | elzo_forms_field_types |
| Override template arguments | elzo_forms/templates/template_args |
| Register a custom module | elzo_forms/modules/register |
| Register a custom PRO automation action | elzo_forms_pro_automation_actions |
| Register a custom PRO automation condition | elzo_forms_pro_automation_conditions |
Related developer guides
- Developer Overview
- JavaScript Events API
- Template Overrides
- Building a Custom Automation Action
- Building a Custom Automation Condition
- Module Development
- Security Best Practices