---
title: "Enable Enhanced Security: the secret attribute for shortcodes"
date: 2026-04-23
updated: 2026-10-20
author: "GravityKit"
link: "https://www.gravitykit.com/docs/gravityview/view-setup/enable-enhanced-security-the-secret-attribute-for-shortcodes/"
category: "GravityView > View Setup"
---

With **Enable Enhanced Security** on, a shortcode shows a View's entries only when it includes the View's `secret` attribute, a code GravityView makes for that View. When the setting is off, anyone who can add a shortcode to a post or page on your site can show the View's entries by using its ID.

The setting covers embeds only. The View's own address (`/view/…/`) stays open to visitors until you turn on **Prevent Direct Access**, explained in [The GravityView Direct Access Setting](https://www.gravitykit.com/docs/gravityview/view-settings/the-direct-access-setting/).

## Turn Enhanced Security on or off

New Views have the setting on. To check it or change it for a View:

- Edit the View.
- In the **Settings** box, click **Permissions**.
- Turn **Enable Enhanced Security** on or off.
- Click **Update**.

![The Permissions tab of the View's Settings box, with the Enable Enhanced Security toggle turned on and outlined](https://www.gravitykit.com/wp-content/uploads/2026/04/gravityview-permissions-enable-enhanced-security.png)Once it is on, visitors see nothing from a shortcode embed of the View that lacks the secret, so add the secret to those shortcodes at the same time. Turn it off only for a View whose entries anyone who edits your site may see.

## Shortcodes that need the secret

With the setting on, these shortcodes show nothing for the View unless they include its `secret`:

- `[gravityview]`, which embeds the View
- `[gventry]` and `[gvfield]`, which show one entry or one field value
- `[gv_entry_link]`, and the older `[gv_edit_entry_link]` and `[gv_delete_entry_link]`
- `[gravitymath scope="view"]` from [GravityMath](https://www.gravitykit.com/docs/gravitymath/math-shortcode/)

Add the attribute with the View's secret, as in this example for a View with the ID 2 and the secret `abc123`:

```
[gravityview id="2" secret="abc123"]
```

A shortcode inside the View it names, such as in a [Custom Content field](https://www.gravitykit.com/docs/gravityview/getting-started-gravityview/using-the-custom-content-field/), needs no secret.

## GravityView blocks

A GravityView block adds the secret for you when you pick the View in the block's **View** setting. A block added while the View had Enhanced Security off has no secret, so it shows nothing to visitors once you turn the setting on. To fix it, edit the page, select the block, pick the same View again in **View**, and save the page.

## Find a View's secret

While the setting is on, you can copy the View's shortcode, secret included, from:

- the **Embed Shortcode** field in the **Publish** box of the View editor. Click the field to copy the shortcode.
- the **Shortcode** column of the **All Views** screen (**GravityKit**, then **All Views**).

![The Publish box in the View editor, with the Embed Shortcode field outlined](https://www.gravitykit.com/wp-content/uploads/2026/04/gravityview-publish-box-embed-shortcode.png)
For the other shortcodes, copy only the `secret="…"` part

## When the secret is missing or wrong

Visitors and most signed-in users see nothing where the shortcode is. Users who can edit forms in Gravity Forms, which by default means administrators, see a message in its place with the attribute to add:

> The  shortcode is missing or has an invalid "secret" attribute. Update the shortcode with the following attribute: secret="abc123"

GravityView also lists the problem on the WordPress **Dashboard** for administrators once someone who cannot edit the View opens the page. The notice names the shortcode and links to the page, for example " shortcode on Member dashboard is missing or has an invalid "secret" attribute."

To fix it, add the secret to the shortcode, then update the page.

## Changing a View's secret

GravityView has no setting to change a View's secret. If someone who should not see the View has its secret, [contact support](https://www.gravitykit.com/support/).