Some jobs cannot be priced or started without seeing something first: a photo of the damp patch, the artwork for a print order, a floor plan, a signed document. At the moment your customers probably email or WhatsApp these separately, and you spend time matching attachments to enquiries.
A file upload form puts the file and the details in one submission. It is easy to add, but it is also the one kind of form where a careless setting can let someone put a harmful file on your server or fill your mailbox. This post covers the decisions that matter: which files to accept, how big, where they go and how to keep the whole thing safe.
Decide what you need to receive
Start with the job, not the plugin. Write down:
- What kind of file. Photos? PDFs? Design files? Most businesses need two or three types, not twenty.
- How many. One photo, or up to five?
- How large. A phone photo is a few megabytes. A video or a large design file can be hundreds.
- Whether it is required. Usually it should be optional, so people without a file can still contact you.
If the honest answer includes videos or very large files, a form is probably the wrong tool. It is often better to ask for details in the form and then send the customer a link to a shared folder in Google Drive, Dropbox or OneDrive.
Which form plugins can accept uploads
All the well-known form plugins have a file field, with differences in how they store the file and which version includes it.
- Contact Form 7 has a file field in the free plugin. You set allowed types and a size limit in the field’s tag.
- WPForms, Fluent Forms and Gravity Forms each have a file upload field, often with a drag-and-drop area and support for several files. Check whether it is in the version you have.
Whichever you use, the questions below are the same.
Setting allowed file types
Allow only the types you need, by listing them. Do not rely on the plugin’s default list without reading it.
- For photos: jpg, jpeg and png. Consider heic as well: iPhones save photos in HEIC format by default, and depending on how the customer picks the file, the upload can arrive in that format. Check that you can open them on your own computer first.
- For documents: pdf, and doc or docx only if you need to edit what you receive.
- Never allow: php, exe, js, html, or anything else that can run as code. Be cautious with svg, which can contain scripts, and with zip files, which hide what is inside.
In Contact Form 7, a file field with a type list and limit looks like this:
[file your-photo limit:5mb filetypes:jpg|jpeg|png|pdf]
In the other plugins, the allowed extensions and maximum size are in the field’s options when you click it in the builder.
Size limits: there are two
A file has to pass two limits, and the lower one wins.
- The form field’s own limit, which you set in the plugin. Contact Form 7’s default is small, so set it yourself if you expect photos.
- The server’s upload limit, set by PHP on your hosting. If the server allows less than the form field, uploads fail even though the form says they should work.
You can see the server’s figure in Media → Add New Media File, where WordPress shows the maximum upload size. If you need to raise it, our guide to WordPress’s maximum upload size explains the safe ways.
Then there is a third, hidden limit: email. If the plugin attaches the file to the notification, the mail service may refuse very large attachments. Keep the field limit modest, or use a plugin setting that sends a link to the file instead of attaching it.
Where uploaded files end up
This differs by plugin and it matters for both privacy and backups.
Attached to the email only
Contact Form 7 stores the file briefly while sending, attaches it to the email and then removes it from the server. To include it, put the field’s tag, such as [your-photo], in the File attachments box on the Mail tab. If you forget, the visitor uploads the file and you never receive it. The file then exists only in the mailboxes that received it.
Stored on your site
Plugins such as WPForms and Gravity Forms usually save uploads in a folder of their own inside wp-content/uploads and link to the file from the entry and the email. The file stays there until you delete it. These files normally do not show in your Media Library, so they are easy to forget.
Sent elsewhere
Some plugins have add-ons that send uploads to cloud storage such as Google Drive or Dropbox. That keeps large files off your hosting, but it is one more connection to check after updates.
Keeping a file upload form secure
An upload field lets strangers put files on your server, so it deserves more care than a plain text form.
- Allow only the file types you listed above.
- Keep the form plugin updated. File upload handling has been behind serious plugin security fixes before, so do not delay these updates.
- Keep spam protection on. Bots that find an open upload field will try it.
- Do not make uploaded files visible on the public site, for example by showing them in a gallery automatically.
- Run a malware scan through your security plugin or host. A PHP file appearing inside the uploads folder is a warning sign, and our article on PHP files in the uploads folder explains why.
- Treat uploaded Office documents with care on your own computer. Open them with macros disabled.
Privacy and clearing old files
Uploaded files often hold more personal information than the form itself: photos of someone’s home, identity documents, signatures, medical letters. Ask for documents like ID only if you truly need them, and tell people what you will do with them near the field.
Decide how long you keep files, and delete them from the site, the entries screen and your inbox when the job is done or the request is closed. Remember that stored uploads also appear in every full backup of the site. For CVs and applications in particular, which have their own retention questions, see our guide to job application forms on WordPress.
Test with real files
Before you put the form live, try it the way customers will:
- Upload a photo straight from a phone, over mobile data.
- Upload a PDF from a computer.
- Try a file that is too large and one of a type you do not allow, and read the error message. It should tell the visitor what to do.
- Check the notification arrives with the file attached or linked, and that the file opens.
If the field is part of a larger enquiry, our guide to building a quote request form shows where an optional upload fits. For the full picture of forms on your site, start with our forms guide for business owners, and see the WordPress help guide for everything else.
Frequently asked questions
Can I accept files larger than my hosting allows?
Not through the form itself, because the server rejects the upload before the form plugin sees it. You can ask your host to raise the limit within what your plan supports, or keep the form for details and send the customer a link to a shared cloud folder for very large files such as videos or detailed drawings.
Why do uploads fail for some visitors on their phones?
The common causes are a file type the form does not allow, such as HEIC photos from an iPhone, a file larger than the field or server limit, and a slow mobile connection timing out. Check the form’s error message wording, test on a phone yourself and consider allowing HEIC or asking for smaller photos.
Do form uploads appear in the WordPress Media Library?
Usually not. Most form plugins keep uploads in their own folder or attach them to the email, separate from the images you add to pages. That is deliberate, because customer files should not be mixed with your public media. It also means you need to clear them through the form plugin or your hosting file manager.
Is it safe to accept Word or Excel files?
It can be, if you need them. The files themselves will not run on your website, but documents with macros can harm the computer that opens them. Allow them only when necessary, open them with macros disabled, and keep antivirus up to date on the machines your team uses. PDF is the safer choice for most purposes.
When uploads keep failing, the cause is normally the form, the server limit or the email, and it takes some checking to tell which. Our WordPress bug fixing service can work through those with you if files are not reaching you.
Next in this series: How to Build a Multi-Step Form in WordPress
