Banned Meta Keys Validation & Site Health Check (UM 2.10.3)

Overview

Starting in Ultimate Member 2.10.3, improvements were made to how banned meta keys are handled when creating and managing form fields. These updates improve site stability by:

  • Notifying admins immediately when they attempt to use a banned meta key in a form.
  • Display a warning in Site Health if any banned keys exist in form fields.

What Are Banned Meta Keys?

Banned meta keys are reserved meta keys in WordPress and Ultimate Member (like user_login, user_email, roles, etc.) that should not be used for custom form fields. Doing so could cause serious conflicts with core or plugin functionality.

Banned Meta Keys

These keys are either sensitive, system-reserved, or conflict-prone, and Ultimate Member prevents them from being used as custom meta keys:

  • metabox
  • postbox
  • meta-box
  • dismissed_wp_pointers
  • session_tokens
  • screen_layout
  • {$wpdb->get_blog_prefix()}user-(dynamic based on site prefix, e.g., wp_user-)
  • dismissed
  • cap_key
  • {$wpdb->get_blog_prefix()}capabilities (e.g., wp_capabilities)
  • managenav
  • nav_menu
  • user_activation_key
  • level_
  • {$wpdb->get_blog_prefix()}user_level (e.g., wp_user_level)

Blocked User Meta Update Keys

These are critical WordPress core user properties — and Ultimate Member restricts updating them via user meta processes for security and integrity reasons:

  • user_email
  • user_pass
  • user_password
  • display_name
  • user_url
  • role

How It Works in version 2.10.3

Form Field Meta Key Validation

When adding or editing a field in Forms → Edit Form → Fields:

  • If you enter a banned meta key in the Meta Key setting, an inline warning message appears: "Your meta key can not be used"
  • You will be prevented from saving the form field or updating it until you choose a valid, non-banned meta key.
  • Fields created before the meta key restrictions took effect will also display a warning if they use a banned key, stating:
    “This is not permitted for security reasons. For your safety, please remove it.”

Site Health Status Check

A new Site Health Check was added under Tools → Site Health → Status.

  • If any active form fields are using banned meta keys, the site health report will show a critical issue.
  • It will list the affected keys so you can quickly identify and fix them.

See example below:

A validation system was introduced to prevent the use of certain restricted meta keys within form fields. These meta keys are considered sensitive because they are either used internally by WordPress or Ultimate Member, or they have the potential to interfere with your site’s functionality and security.

Example from Site Health Status

Affected Form: Test Banned Keys (ID: 71)
Banned Field:

  • User ID (user_id)

This means a field in your form is using a meta key (user_id) that belongs to a restricted list maintained by Ultimate Member. Meta keys like this are blocked to prevent possible conflicts or vulnerabilities.

Why This Matters

Allowing the use of banned meta keys in forms could:

  • Break website functionality (e.g. overwriting important user meta data)
  • Cause conflicts with WordPress core operations or other plugins
  • Lead to potential security risks by unintentionally exposing or modifying sensitive data

That’s why Ultimate Member now performs this check and displays a Site Health notice if any banned meta keys are detected.

What You Should Do

To resolve this:

  1. Go to wp-admin → Ultimate Member → Forms
  2. Edit the form listed in the notice (Test Banned Keys)
  3. Remove or replace any fields using banned meta keys (like user_id)
  4. Save the form

Once updated, the Site Health status will no longer flag this issue.

Related Articles