Form Forge’s File Upload field lets users attach files to form submissions — resumes, photos, documents, spreadsheets, anything. Security is built in: file types are checked by MIME type, not just extension, sizes are enforced server-side, and uploaded files are stored safely outside the public directory by default.
Specify which file types the user is allowed to upload:
application/pdfForm Forge verifies the actual file content, not just the extension. A .php file renamed to .jpg will be rejected.
Set a per-field maximum file size in megabytes. Typical values:
Server-side validation enforces the limit even if the client-side check is bypassed.
Enable multi-file upload so users can attach several files in one field — useful for photo galleries, document batches, or project portfolios.
When multi-file is on, set a maximum count. Prevents users from attaching 50 files to one submission.
Form Forge reads the first bytes of every uploaded file (the “magic bytes”) to verify the actual file type matches the extension. This catches common attacks like uploading a PHP script renamed to .jpg.
By default, uploaded files are stored in a directory outside the public uploads folder with a randomized filename and a directory structure that prevents direct URL guessing. Admins access uploads through the WordPress admin, which checks capabilities before serving the file.
Only users with the edit_submissions capability can download uploaded files from the admin. For sensitive uploads (job applications, medical records, legal documents), this keeps attachments protected.
Uploaded files are never executed. If someone uploads a PHP file (and somehow passes MIME validation), the directory it’s stored in has execution explicitly disabled via .htaccess or equivalent server-level rules.
For enterprise or healthcare use cases, Form Forge provides hooks for third-party antivirus scanning before a file is accepted. Integrate with your existing AV solution.
When a form is submitted with uploaded files, Form Forge includes them in the email notification as attachments (if their size is within your email provider’s limit) or as download links to the quarantined files in the WordPress admin.
You can configure this per form:
For integrations that need file data (Mailchimp, HubSpot, Google Sheets), Form Forge passes the file URL, filename, MIME type, and size. Services that support attachments (Slack, Discord, Telegram, email) can receive the file directly.
Form Forge’s admin includes a Files view showing all uploaded files across all forms with:
Purge old submissions and their files on a schedule to manage storage usage on large sites.
Get Form Forge — from $49/year →
The File Upload field is included in every version of Form Forge, including the free one.