Add a File Upload Field Safely

Use case

Collect photographs of faults, site evidence, completed documents or other files attached to a submission.

Steps

1. Edit the required form.
2. From the field library, add File Upload.
3. Give it a precise label, such as “Upload photograph of fault”.
4. In field settings, set the allowed file extensions to the types actually needed. For photographs, this might include JPG, JPEG, PNG or HEIC only if the site supports it.
5. Set a maximum file size that suits mobile uploads and your hosting limits.
6. Enable multi-file upload only if users genuinely need to attach more than one file and your installed version supports the setting.
7. Make the field required only when evidence is mandatory for that submission route.
8. If the upload should only appear for a fault, enable conditional logic and test both fault and no-fault routes.
9. Save the form and submit a test file from a mobile device.

Security and privacy

Only accept the file types required for the workflow. Restrict form access where uploads may contain personal, client or site-sensitive information. Review who can access entries and uploaded files. Do not assume that hiding a file link on a page makes the underlying file private.

Troubleshooting

• File type rejected: check the allowed extensions and WordPress permitted MIME types.
• File too large: reduce the image size or review the configured upload limit and server PHP limits.
• Upload fails on mobile: test another network, reduce image size and review server logs.
• File is missing from an email: check the notification settings and use a secure access route where appropriate rather than assuming an attachment is included automatically.

Official references: File Upload Field and File Upload Security.