Many form plugins store every submission in the site's database as well as emailing it. Find where entries are kept, decide how long you need them, move anything important elsewhere, and delete the rest on a schedule.

Two copies of every message

When somebody fills in the contact form on your website, an email arrives. That is the copy everybody knows about.

On many sites there is a second copy. Several popular form plugins also save each submission in the site's database, on an entries screen nobody at the business ever opens.

Left to its defaults, nothing clears that copy. A site launched in 2013 can be holding every enquiry since: names, phone numbers, email addresses, and whatever people wrote in the message box.

Most owners have no idea it is there. The email was dealt with years ago; the database copy simply stayed.

Why plugins keep them

The stored copy exists for a sensible reason. Notification emails sometimes fail, caught by a spam filter or sent to an address that has changed, and the database copy means no enquiry is lost.

It also makes forms easier to manage. Entries can be searched, exported to a spreadsheet, or marked as dealt with.

What is rarely set up is the other half of the job. Most plugins keep entries indefinitely unless somebody tells them otherwise, and nobody does.

Where submissions actually end up

The second is the one nobody looks for. Deleting a plugin from the dashboard often leaves its database tables behind, so a form replaced in 2016 may still hold every entry it ever received.

What is in them

Contact forms collect more than they appear to. People write freely in a message box, because they think they are writing to a person.

A clinic's form holds descriptions of symptoms. A contractor's holds home addresses and the dates the owners will be away. An accountant's holds questions about money that people would not post anywhere else.

Spam sits in there too, often thousands of entries of it. That is how many owners first learn the table exists: the database has grown large enough for somebody to ask why.

How long to keep them

Canadian privacy law expects personal information to be kept only as long as it is needed for the purpose it was collected for, and then destroyed or made anonymous.

For most enquiries, that purpose ends quickly. The person got their answer, booked the job, or went elsewhere.

A short retention period, such as ninety days, keeps the safety net for failed emails and removes the archive. Enquiries that became work move into the customer's file, where your other records live.

Whatever the period, write it down. A retention period that exists only in somebody's head is never applied.

A worked example

A tutoring centre above a row of shops took enquiries through its website from parents looking for help for their children.

The form asked for the child's name, grade and school, and had a box for anything else the centre should know. Parents used it to describe diagnoses, trouble with reading, and difficult years at home.

When the site moved to a new host last autumn, the developer noticed the database was far larger than a small site's should be.

Most of it was form entries: several thousand, going back to 2013, in two tables. One belonged to the current form plugin; the other to a plugin removed three years earlier.

Current students' details were already in their files, so every entry was deleted. The old table went too, and the form now deletes entries after ninety days.

Then came the step people forget: the backups taken before the clean-up were deleted once the site was confirmed working, so the entries did not live on in an archive.

Deleting them safely

First, decide what must be kept, and export it into the place it belongs: the customer file, the job record, or a spreadsheet with its own retention date.

Then take a backup, delete through the plugin's own screen, and check the site still works.

Leftover tables from removed plugins should be dropped by whoever maintains the site. Removing the wrong table can take the site down with it.

Finally, deal with that backup. Keep it long enough to be sure nothing broke, then delete it, or it becomes the archive you just removed.

Making it automatic

Some form plugins added a retention setting last year, among other privacy features. Once it is set, entries are deleted automatically after a chosen number of days.

WordPress itself gained privacy tools last May, under the Tools menu, which can export or erase one person's data on request, provided the form plugin connects to them.

Where a plugin has no retention setting, a monthly reminder to clear old entries does the same job, or whoever maintains the site can schedule it.

The inbox is the other archive

The website is only half of it. Every submission also went to an inbox, which lives on the mail server, the office computer and every phone that checks it.

Apply the same period there. A folder the form notifications go into, cleared on the same schedule, keeps the two copies in step.

And if the notifications still go to a former employee's address, fix that at the same time.

The counter-case

Not every site is holding years of submissions.

Some form plugins only send email and keep nothing, and a site with a simple form like that has much less to clean up, though its inbox may still be the archive.

Some businesses need longer records: a firm whose enquiries become client files, or a regulated practice with its own retention rules. Those belong somewhere proper, not in a plugin.

Find what the site is holding, keep what you need where it belongs, and delete the rest on a schedule.

This week

  1. Open the form plugin's entries screen.
  2. Ask for a list of every table holding entries.
  3. Decide a retention period and write it down.
  4. Export what you must keep to its proper place.
  5. Delete the rest through the plugin's own screen.
  6. Set automatic deletion where the plugin allows it.
  7. Clear the notification inbox on the same schedule.

Step two is the one that finds the surprises. The entries screen shows the current plugin's copy; only somebody looking at the database itself will find what earlier plugins left behind.

What the form should ask for in the first place is covered in a contact form that asks for too much.

Frequently asked questions

Does my website keep copies of form submissions?

Often, yes. Many form plugins save every submission in the site's database as well as emailing it, and keep them indefinitely unless somebody sets a retention period.

Why do form plugins store submissions at all?

As a safety net. Notification emails sometimes fail or land in spam, and a stored copy means no enquiry is lost. The problem is that nothing ever clears it.

Does deleting a plugin remove its entries?

Not always. Many plugins leave their database tables behind when deleted, so a form replaced years ago may still hold every entry it ever received.

How long should form entries be kept?

Only as long as they are needed. For most enquiries a short period, such as ninety days, keeps the safety net. Anything that became work belongs in the customer's file.

How do I delete old entries safely?

Export what you must keep, take a backup, delete through the plugin's own screen, and have leftover tables removed by whoever maintains the site. Then delete that backup too.

What about the emails the form sent?

They are the other archive, on the mail server, the office computer and every phone that checks the account. Clear them on the same schedule as the website.

West Coast Media Solutions Inc. provides web design, web development, hosting, digital marketing, and business consulting to organisations across Canada, drawing on more than twenty-five years in the field.

Site collecting form entries since 2013?

Send us the address. We will find every place your website keeps submissions and help you set a retention period.

Start a Conversation