Skip to content
Search Articles/

less than a minute read • Updated 6 days ago

Hide sensitive custom field data from receipts and emails

How to keep sensitive custom checkout field data — like a Social Security or ID number — out of receipts and emails while still keeping it visible on the order in the admin.

By default, every custom checkout field is included in the email receipt sent to both the customer and your store. For information you don’t want emailed — like an account ID number — prefix the field’s name with h: to keep it out of emails.

Steps

  1. 1

    Add h: to the front of your field’s name attribute.

  2. 2

    Reference the field’s value through Twig’s _context object, since the colon in the name means it can’t be accessed as a plain variable:

Please enter your Secret Account ID: <input type="text" name="h:secret_account_id" value="{{ _context['h:secret_account_id'] }}" />

Notes

  • Sensitive fields still appear in the admin’s transaction view and are included in the XML datafeed — the h: prefix only removes them from emails.

  • Don’t use custom fields to collect passwords. Foxy stores custom field values in cleartext, not hashed, so they should never hold sensitive credentials.

Need Help?

Did this article answer your questions? Need help with anything? Please click below to contact us.