WordPress File Upload Form: 6 Simple, Safe Steps

A WordPress file upload form saves a round of emails. Instead of asking a customer to “send the photos over”, the form collects them with the enquiry: the floor plan with the renovation quote, the CV with the application, the artwork with the print order.

This guide shows how to build a WordPress file upload form in six simple, safe steps, how to choose where uploaded files are stored, and the security and privacy rules that keep uploads from becoming a problem. The examples use FillKite Pro’s File upload field.

When a WordPress file upload form helps

If your first reply to an enquiry often asks for a file, that file belongs in the form.

Why uploads need care

Every file upload is a door into your site. Handled carelessly, a WordPress file upload form can let someone upload a harmful file, fill your server’s disk, or expose private documents publicly. None of this is a reason to avoid uploads, but it is a reason to set them up deliberately:

• Harmful files: accept only the types you need, and never scripts or executables.
• Huge files: set a size limit and a maximum number of files.
• Exposed documents: keep CVs, IDs and private documents out of public folders.
• Spam uploads: keep your normal spam protection on; bots attach files too.

Security rules for any WordPress file upload form

The OWASP file upload guidance is the standard reference for handling uploads safely. For a WordPress file upload form, it boils down to a few rules:

• Allow a short list of types, rather than blocking a list of bad ones. New dangerous types appear; a short allow list stays safe.
• Check the file, not just its name. A file called “photo.jpg” should really be an image.
• Limit size and count, so one visitor cannot fill your disk.
• Store files where they cannot run. Uploaded files must never be executed by the server.
• Control who can download them, especially personal documents.

FillKite’s File upload field follows these rules by design: it offers grouped, allow-listed file types, enforces your size and count limits on the server as well as in the browser, and keeps files private unless you choose otherwise.

How to build a WordPress file upload form in 6 steps

1. Add the File upload field

With FillKite Pro active, open your form in the builder and add a File upload field from the field list. Place it where it makes sense, usually near the end, after the details that explain what the file is for.

2. Choose which files to accept

Under Accepted files, tick only what you need. FillKite groups file types so you cannot accidentally allow something dangerous: images (JPG, PNG, GIF, WebP), PDF, documents (Word, OpenDocument, RTF, PowerPoint), spreadsheets (Excel, OpenDocument), and text and CSV. By default, a new field accepts images and PDF.

3. Set limits

Set the Largest file in megabytes and the Most files a visitor can attach. The defaults are 5 MB and 3 files, which suit most forms. The builder shows the largest upload your server accepts, so you do not set a limit your hosting cannot handle.

4. Choose where files are kept

This is the most important decision on a WordPress file upload form. FillKite offers five options under Keep files:

Choose Private unless you have a reason not to. If you pick a cloud option before connecting it, FillKite keeps files private until the connection is set up, so nothing is ever left in an unsafe place.

5. Label it clearly

Tell visitors what to upload and in what format: “Upload your CV (PDF or Word, up to 5 MB)”. Make the field optional unless the file is truly essential; many people fill in forms on phones where their files are not to hand, and a required upload can stop them completely.

6. Test it

Send a test entry with a file from a phone and from a computer. Try a file that is too large and a file of the wrong type, and check that the error messages are clear. Then open the entry and download the file to confirm it arrived.

Three WordPress file upload form examples

Job application

Fields: name, email, phone, role applied for, portfolio link, CV upload (PDF or Word, up to 5 MB, 1 file), cover note, consent. Storage: private, because CVs are personal data. Retention: six to twelve months, in line with your hiring process.

Renovation quote with photos

Fields: name, email, postcode, type of work, budget range, photos (images only, up to 10 MB each, up to 5 files), description. Storage: private or Google Drive if the team reviews jobs there. The photos let you give a realistic range in the first reply.

Print order with artwork

Fields: name, email, product, quantity, size, finish, artwork (PDF and images, up to 50 MB if your server allows, up to 3 files), delivery date. Storage: Dropbox or an S3-compatible bucket if files are large, so they do not fill your web hosting.

In each WordPress file upload form above, the upload sits after the questions that explain what the file is for, and only the second and third make it required.

Your hosting’s upload limit

Your web server sets its own maximum upload size, often through PHP settings such as the maximum file size and the maximum size of a whole form submission. A WordPress file upload form cannot accept files larger than that, whatever you set in the form. FillKite shows your server’s limit under the field’s size setting, so you can see it straight away.

If you need larger files, ask your host to raise the limit, or choose cloud storage for that form. For very large files, such as video, consider asking visitors for a sharing link from their own cloud storage instead of an upload.

What visitors see

A good upload field is easy to use on any device. FillKite’s field accepts drag and drop on a desktop, a “browse” link everywhere, and shows each chosen file with a remove button. If a file is too big or the wrong type, the visitor sees a clear message naming the file, such as “CV.docx is too big. Files can be up to 5 MB.” Files are uploaded when the form is sent, together with the other answers.

Uploads on phones

Most visitors will open your WordPress file upload form on a phone, where uploading works differently. They can pick a photo from their gallery, take one with the camera, or choose a file from their phone’s storage or cloud apps. Test all three. Photos from modern phones are large, so a 5 MB limit may be too low for a form that asks for pictures; 10 MB is a safer choice for image uploads.

Keep the label specific on mobile too, and make sure the error message for a file that is too big tells people what to do next, such as “Choose a smaller photo or send it by email instead.”

An accessible upload field

An upload control must work with a keyboard and screen readers, like every other field. That means a real label, a button that can be reached with the Tab key, clear announcements when a file is added or removed, and errors that name the file. A WordPress file upload form that only works by dragging and dropping leaves some visitors unable to send it. FillKite’s field supports both dragging and a normal browse button, and each chosen file has its own remove button.

Where uploaded files appear for you

Each entry in the FillKite inbox shows its uploaded files as links. For private storage, only people allowed to manage forms can download them, and they must be logged in. Notification emails include links to the files rather than attachments, so large files do not clog inboxes or bounce, and private files stay private.

Privacy and retention

Uploaded files often contain the most sensitive data on a form: CVs with addresses, photos of homes, ID documents. Treat them accordingly. Keep them private, restrict who can manage forms, and set a retention period so old entries, and their files, are deleted automatically. Our guide to the GDPR contact form covers retention and consent in more detail.

What to do with files after the job

Uploaded files pile up quietly. A busy WordPress file upload form can collect gigabytes of photos and documents within a year. Decide early what happens to them: keep files for as long as you keep the entry, move finished jobs to your own archive if you need them longer, and let the retention period remove the rest. If you store files in Google Drive or Dropbox, tidy the FillKite folder there from time to time as well.

Upload or link?

Sometimes a link is better than an upload. For very large files, such as videos or print-ready artwork, ask visitors to paste a sharing link from their own cloud storage in a Website field. It avoids size limits entirely. For CVs, photos and documents, a WordPress file upload form is simpler for visitors, because they do not need to create a link first.

Uploads in longer forms

On long forms, such as job applications, put the upload on its own step or near the end, after the easy questions. A multi-step layout keeps the upload from dominating the first screen. See our guide to the WordPress multi step form.

Choosing cloud storage

Keeping uploads on your web server is simplest, but cloud storage has real advantages for some sites. Files do not use your hosting space, backups stay smaller, and your team can open files in tools they already use. FillKite connects to your own Google Drive or Dropbox and saves files in a FillKite folder there, or to your own private bucket on Amazon S3 or an S3-compatible service such as Cloudflare R2, Backblaze B2 or Wasabi.

In every case the storage belongs to you, not to FillKite. The entry in WordPress keeps a link to each file, so your WordPress file upload form works the same whichever option you choose.

Spam and uploads

Bots attach files too, sometimes to test whether a form accepts uploads at all. Keep your normal spam protection on for every WordPress file upload form: the honeypot, time check and spam score all still apply, and entries caught as spam go to their own folder. Our guide to WordPress form spam covers the layers.

A WordPress file upload form checklist

• Only the file types you need are accepted.
• Size and number limits are set, within your server’s limit.
• Personal documents are stored privately.
• The label says what to upload, in which formats and up to what size.
• The upload is optional unless it is truly essential.
• Notifications link to files instead of attaching them.
• A retention period deletes old entries and their files.
• A test from a phone and a computer works, including error messages.

Where a WordPress file upload form goes wrong

Sharing uploaded files with your team

Once a WordPress file upload form is live, several people may need the files: a recruiter and a hiring manager, a sales person and an estimator. Give each person a role that lets them see entries, so they download files from WordPress with their own login, rather than forwarding attachments around. If the team lives in Google Drive or Dropbox, storing uploads there puts the files where people already work, while the entry in WordPress keeps the record.

Whichever you choose, avoid sharing private files through public links. A WordPress file upload form that collects personal documents should keep them behind a login from start to finish.

Frequently asked questions

Is file upload free in FillKite?

File upload is part of FillKite Pro. The free plugin includes 29 field types, conditional logic, the inbox and spam protection.

What is the maximum file size?

You choose it per field, up to the limit your server allows. The builder shows your server’s limit. The default is 5 MB per file and 3 files per entry.

Can uploaded files go straight to Google Drive?

Yes. Choose Google Drive under Keep files and connect your account. Files are saved in a FillKite folder in your own Drive. Dropbox and S3-compatible storage work the same way.

Can visitors upload more than one file?

Yes. Set Most files to the number you want, up to 10 per field. Each file is checked against the type and size limits.

Can I use a WordPress file upload form in Elementor?

Yes. Build the form in FillKite and place it with the FillKite Form widget. The upload field works the same on any page.

Are uploaded files safe from the public?

With private storage, yes: only logged-in people who can manage forms can download them. Choose the Media Library only for files you want to be public.