Until now, hiring has meant “send your CV to info@”. The applications arrive mixed in with enquiries and invoices, some people attach a photo of a printed CV, others forget to say which role they want, and a year later the inbox still holds dozens of strangers’ personal details that nobody meant to keep. A proper job application form in WordPress fixes most of that, as long as you decide a few things before you build it.
This post covers the fields worth asking for, receiving CVs, who can see the applications, and how to delete them when you no longer need them. It is written for a small business hiring a few people a year, not for a recruitment agency.
Three decisions to make first
Who reads the applications? Name the person or people. This decides where notifications go and who needs access to stored entries.
Where will they be kept? In an email inbox, in the form plugin’s entries inside WordPress, or both. Each place is somewhere personal data sits and has to be cleaned out later.
How long will you keep them? Pick a period, for example a set number of months after the role is filled, and write it into the privacy notice on the form. Data protection laws in the UK, the EU and India all expect you not to keep personal data longer than you need it, without setting one fixed number for job applications. If you are unsure what is right for your business, ask someone who advises on employment or data law where you operate.
Fields worth including
- Full name, email and phone number. Use the plugin’s Email and Phone field types so the address is checked and phones show the right keyboard.
- The role being applied for. A dropdown if you have several openings, or a hidden or preset value if each role has its own form.
- Location or willingness to travel, if the job is site-based.
- Notice period or earliest start date.
- The CV, as a file upload. More on this below.
- A short box for anything else, such as “Why does this role interest you?”. Keep it optional or short; long essays on a phone put good people off.
- A link field for a portfolio or LinkedIn profile, if it matters for the role.
- A line about privacy near the Submit button, saying who will see the application, how long you keep it, and linking your privacy policy.
Fields to leave out
Do not ask for date of birth, a photograph, marital status, religion, or similar details unless the law in your country actually requires them for the role. They are rarely needed to decide whom to interview, and in many countries asking for them raises discrimination concerns. In the US, some states and cities also restrict asking about salary history. If you are not certain a field is needed and allowed, leave it out.
Receiving CVs through the form
Add a file upload field and limit it to the formats you can open, usually PDF and Word documents. Allow one file, set a sensible size limit in the field settings, and say both on the form, for example “PDF or Word, one file”. The field’s limit cannot be higher than your hosting allows, and if uploads fail for larger files our post on the WordPress maximum upload size explains why.
How uploaded files are handled, where each plugin stores them and how to keep them safe is covered in our post on letting customers upload files through a form. Two points matter especially for CVs. Contact Form 7 attaches the file to the notification email and does not keep its own copy on the site, so the inbox becomes the only record. Plugins that store entries usually keep the file in a folder inside your site’s uploads, and depending on the plugin and settings, a file there may be reachable by anyone who has its exact web address. Check what your plugin does before you rely on it for personal documents.
Building the job application form in WordPress
- Create a new form. Many form plugins include a job application template, which is a reasonable start. Remove anything you do not need.
- Add or adjust the fields from the list above, and mark as required only those you truly need to decide on an interview.
- Set up the notification to the person who reads applications, not to a shared inbox the whole office can see. Put the applicant’s email in the Reply-To so you can answer straight from the email.
- Write the confirmation the applicant sees on screen, and optionally an automatic email. Keep it factual: the application arrived, and you will be in touch if they are shortlisted. Do not promise to reply to everyone by a date you may not meet. Our post on sending a confirmation email to the person who filled in a form covers the wording.
- Turn on entry storage if your plugin offers it, so an application is not lost if an email goes astray. See storing form submissions in WordPress for the options.
- Create a Careers page with each role’s description and the form beneath it, and link it from your menu or footer.
- Submit a test application with a real PDF, and check that the email arrives, the file opens and the entry is stored.
One form for all roles, with a dropdown, is usually easier to look after than a separate form per job. When nothing is open, replace the form with a short note saying so, or invite speculative applications if you genuinely read them.
Who can see the applications
Inside WordPress, stored entries are usually visible to administrators, and anyone with an administrator account can open every application and its CV. That is a good reason not to give a hiring manager full admin access just so they can read applications. Some form plugins can grant entry access to other roles, sometimes with help from a role editor plugin, and the post on WordPress user roles explains what each standard role can reach.
Email needs the same thought. If applications go to a shared mailbox, everyone with access to that mailbox can read them, and forwarding CVs around the team spreads copies into more inboxes. Decide where the single working copy lives and keep it there.
Deleting old applications
When your retention period ends, delete the application everywhere it exists. That usually means:
- the entry in the form plugin;
- the uploaded CV file, since in some plugins deleting an entry does not remove its file, so check the uploads folder or the plugin’s settings;
- the notification emails in each inbox that received them;
- any copies downloaded to computers or shared drives.
Some plugins can delete entries automatically after a set time. If yours can, it is worth using for this form. Set a calendar reminder otherwise.
For keeping the rest of the site in order, see our guide to managing a WordPress website, and for how this fits with your other forms, the forms guide for WordPress sites is the starting point.
Mistakes that cause trouble later
- Sending applications to an address nobody checks, often an old staff member’s email left in the notification settings.
- Leaving an old role’s form live for months, so people apply for jobs that no longer exist and never hear back.
- Asking for everything up front. References, certificates and identity documents belong later in the process, after you have decided to go further.
- No record of what you told applicants. Keep a copy of the privacy wording that was on the form, in case anyone asks later.
Frequently asked questions
Do I need a separate form for each job opening?
No. Add a dropdown listing the current roles and update it as roles open and close. If different roles need different questions, conditional fields can show the extra questions only for the role selected. One form is easier to maintain, and all applications end up in one place with the role clearly marked.
Can I share applications with an outside recruiter or adviser?
Only if your privacy wording on the form tells applicants it may happen. Share the specific applications that person needs, through one access-controlled link or account rather than forwarded attachments, and remove their access once the role is filled. Ask them to delete their copies at the end of your retention period too.
Should I use a recruitment plugin instead of a form?
If you post many roles, want listings with their own pages, or need to track candidates through stages, a job board plugin such as WP Job Manager or a separate hiring tool may suit you better. For a small business hiring now and then, a well-built form and a Careers page are usually enough.
Can applicants upload more than one document?
Most form plugins can allow several files on one upload field or let you add separate fields, such as one for a CV and one for a cover letter. Keep it to what you will actually read. Each extra file is more personal data to store, protect and delete later.
A careers form holds more personal data than almost any other form on a small business site, so it is worth getting the setup right the first time. Our WordPress support team can help you build one with sensible fields and storage, and test it with you.
Next in this series: Thank-You Page After Form Submission in WordPress
