ScrubDrop › Guides

Word forms with content controls and legacy form fields: the names, choices and earlier answers that travel with the file

Last updated: 28 October 2026

This page is for people who make or pass on Word forms: an application form, an intake or order form, a checklist that a team fills in, a template that started life as last year's filled-in copy. It is about what the controls of a form keep. Custom XML parts in general, document variables and embedded objects are in custom XML and embedded objects in Word files; the template's name and the other properties are in Word document properties.

Two kinds of form controls

Microsoft's page on creating forms in Word describes content controls "for elements such as check boxes, text boxes, date pickers, and drop-down lists", inserted from the Developer tab, and adds: "Optionally, these content controls can be linked to database information." It describes a second kind as well: "Legacy form controls are for compatibility with older versions of Word and consist of legacy form and Active X controls." Older forms, and forms made from old templates, often use the legacy fields. Both kinds keep settings that are easy to overlook, and some of them were written for the people who made the form rather than those who fill it in.

What the controls keep

The quotations in the rows on titles, tags, choices and data binding are from Microsoft's page Create a fillable form; those on legacy fields are from the page on creating forms linked above. The file format standard, ISO/IEC 29500, as quoted on Microsoft's Open XML SDK pages, adds detail. It calls the tag "an arbitrary string which applications can associate with a structured document tag in order to identify it without providing a visible friendly name" (tag). Each list item "shall be displayed in the list" (listItem). A legacy drop-down's entries are kept in order, and the selection is stored as "the zero-based index of the currently selected entry" (result). For help text, "the method or user interface by which this help text can be surfaced is not defined" by the standard (helpText), and the standard says the same of status text. The standard leaves it to the program how to show them, and they are meant for whoever fills in the form.

None of this is secret in itself. It matters when the words were written for the people who made the form: a tag that names the client the form was built for, a drop-down whose stored values are internal codes or prices, help text that whoever fills in the form can read, such as "ask HR before accepting", or a list of choices that names other customers, staff or sites.

Placeholder text and bound values

Placeholder text is defined outside the control. The standard says the docPart setting names "the document part which shall be displayed in the parent structured document tag when its run contents are empty", and those document parts are kept in the glossary document, which the standard calls a "supplementary document story" in the same file. While a control is empty, the text it shows is also written into the control and marked as placeholder text: the content "shall be interpreted to contain placeholder text for this structured document tag" (showingPlcHdr). A placeholder that once said "Type the client's name" is harmless; one edited to show an example answer, with a real name in it, travels in the file.

A control bound to data shows a value from a custom XML part. The standard says that when the binding finds its element, "the contents of that element shall be used" in place of the text in the control (dataBinding). The part is separate from the controls, so deleting a control does not by itself take its data out of the file; what custom XML parts can hold, and how to remove them, is in custom XML and embedded objects. Microsoft's page Remove hidden data and personal information by inspecting documents, presentations, or workbooks lists among the Word items Document Inspector removes "Databinding link information for data bound fields (last value will be converted to text)".

A filled-in form reused as a template

The quickest way to make next month's form is to copy this month's. Whatever the last person typed stays wherever it was not typed over: an answer in a control nobody had to change, a ticked check box, a choice left selected in a drop-down, a bound value in the custom XML part. A legacy text field keeps its answer as the field's result, and its default text and help text as well. Start a new form from the blank template rather than from a filled-in copy, and if you have to start from a copy, clear every control and read the custom XML parts.

Restricting editing to filling in forms does not hide any of this. The standard's note on documentProtection says: "This protection does not encrypt the document, and malicious applications might circumvent its use. This protection is not intended as a security feature." Excel's sheet protection does not encrypt the cells either; see sheet protection is not encryption.

Check the controls in Word

1. Work on a copy, and show the Developer tab.
2. Select each content control and choose Developer › Properties. Read the Title and the Tag, and, for drop-down lists and combo boxes, every Display Name and Value. Use Modify or Remove for the ones that should not go out.
3. For legacy fields, select each field and open its options. Read the default text, the bookmark name, the help text and, for drop-downs, every item.
4. Clear the answers in a form you are sending out blank, including check boxes and drop-down choices.
5. Run Document Inspector (File › Info › Check for Issues › Inspect Document) to remove custom XML data and document properties. Bound controls then keep their last value as text.

Check a copy of the file

1. Make a copy of the .docx, rename it to .zip and unzip it.
2. Open word/document.xml in a text editor. Search for w:alias, w:tag and w:listItem (content controls), and for w:ffData, w:default, w:helpText, w:statusText and w:listEntry (legacy fields). Do the same in the header and footer parts beside it.
3. A customXml folder holds data parts; open each item file and read it. A word/glossary folder holds placeholder text and building blocks; read word/glossary/document.xml.
4. Finding nothing this way shows only that these searches found nothing, not that the file holds nothing else.

What ScrubDrop does

ScrubDrop reads the .docx in your browser; the file is not uploaded. First, a limit: placeholder text is kept in a glossary part, so a form built with content controls can carry one, and ScrubDrop does not clean a document with a glossary part. It lists the glossary part, under the parts it does not keep, and refuses to clean the file, in both versions, rather than guess at what the part holds. Microsoft's pages do not say when Word adds a glossary part, so look for a word/glossary folder in a copy of your form first. For other files, for free, it lists content control tags and data bindings, along with custom XML parts and the other kinds of hidden data it supports, and removes document properties, comments and tracked changes (by accepting them), one file at a time. ScrubDrop Pro also removes content control tags, data bindings and custom XML parts; the text a bound control shows stays.

Some form settings are neither listed nor removed, in either version: content control titles, the choices of drop-down lists and combo boxes with their values, check box settings and the names of placeholder parts, and in legacy form fields the field name and its bookmark, the default text, the help and status text and the drop-down entries. Edit those in Word as above. The Restrict Editing setting itself is kept; exceptions that let named people or groups edit parts of the document are listed with the document properties and removed with them, so the cleaned document stays restricted with no editable ranges. Add the exceptions again in Word if you need them. The result is read again with separate parsers, and a file that does not pass is not offered.

Questions

Sources: the Microsoft pages linked on this page were checked on 28 October 2026. ScrubDrop is not affiliated with Microsoft.