File Upload Forms
Fillin Forge’s File Upload field lets users attach files to form submissions — resumes, photos, documents, spreadsheets, anything. Security is built in: file types are checked by MIME type, not just extension, sizes are enforced server-side, and uploaded files are stored in a private folder under random file names.
What the file upload field supports
Allowed file types (MIME type validation)
In the field settings, tick the file types the user is allowed to upload:
- ImagesJPG, PNG, GIF, WebP
- WordDOC, DOCX
- Text / CSVTXT, CSV
Need a different list? Type your own MIME types or extensions in Custom accept. It overrides the checkboxes. Some types are always refused, whatever you type: SVG, HTML, XML, PHP and other scripts, and executables such as EXE.
Fillin Forge verifies the actual file content, not just the extension. A .php file renamed to .jpg will be rejected.
File size limits
Set a maximum file size in megabytes for each upload field. The default is 10 MB, and the highest limit you can set is 100 MB. Typical values:
- Resumes / documents: 5–10 MB
- Photos: 10–20 MB
- High-res images: 25–50 MB
- Large files: up to 100 MB
Server-side validation enforces the limit even if the client-side check is bypassed.
One file per field
Each upload field takes one file. If you need several files, add several upload fields.
Security features
MIME type validation
Fillin Forge checks every upload with the WordPress file type check, which looks at the file itself as well as its name. This catches common attacks like uploading a PHP script renamed to .jpg.
Private upload folder
Uploaded files are stored in a private folder inside the WordPress uploads folder, under random file names. Fillin Forge adds an .htaccess rule that blocks direct access on servers that read .htaccess. Admins download uploads through the WordPress admin, which checks the user’s permissions and a security token before serving the file.
Capability checks
Only users with the manage_options capability (administrators) can download uploaded files from the admin, and every download link carries a security token. For sensitive uploads (job applications, medical records, legal documents), this keeps attachments protected.
Dangerous file types are refused
Whatever the field settings say, Fillin Forge always refuses SVG, HTML, XML, PHP and other script files, and executables such as EXE. Files are served to admins as downloads, not opened in the browser.
Common use cases
Job applications
- Resume (PDF, DOC, DOCX, max 10 MB, required)
- Cover letter (PDF, DOC, DOCX, max 5 MB, optional)
- Portfolio link (URL field, alternative to upload)
RFPs and quotes
- Project brief (PDF, DOCX, max 20 MB)
- Reference materials (max 10 MB, one upload field per file)
Customer support tickets
- Screenshots (PNG, JPG, max 5 MB)
- Text logs (TXT, max 2 MB)
Photo submissions
- Contest entries (JPG, PNG, max 20 MB)
- Before/after images (JPG, PNG, max 10 MB each)
Medical intake
- Insurance card photo (JPG, PNG, max 5 MB)
- Previous records (PDF, max 25 MB)
Notifications
The email notification shows the original file name as the value of the upload field. The file itself is not attached. Open the submission in the WordPress admin to download it.
Webhooks
A webhook receives the upload field’s label and the original file name, not the file itself.
Managing uploads
Each uploaded file is shown with its submission on the Submissions screen, with a download link for administrators. When you delete a submission, its uploaded file is deleted with it.
Ready to accept file uploads?
The File Upload field is included in every version of Fillin Forge, including the free one.