File upload (Pro)

With LocalForm Pro active, File Upload is available as a question type in the builder.

Setting it up

1. Add a question and set its type to File Upload.
2. Configure Allowed file types as a comma-separated list of extensions (default: pdf,doc,docx,jpg,jpeg,png).
3. Configure Max file size (MB) (default: 10 MB). This is capped automatically to your server's own upload limit, whichever is lower.

How it behaves

• Storage: uploaded files are moved into a private directory under wp-content/uploads/localform-private/, outside the public media library. The directory is hardened against direct browsing and execution (.htaccess deny rule, no directory listing).
• Validation: both the file extension and the real file type (not just the extension) are checked server-side against your allow-list. The declared size and an upload-error check are also enforced. A handful of extensions (.php, .js, .svg, and similar) are always blocked, regardless of your allow-list.
• Access: files are never served from a public URL. The submissions table and XLSX export show a download link that only site administrators (manage_options) can use - anyone else who follows the link is rejected.
• Responses summary: file upload questions don't currently get a chart on the Summary tab; view individual uploads from the Individual tab.

Notes

• One file per question. There is no multi-file upload in this version.
• Global Field Templates do not currently support File Upload (a template's allow-list/size limit would need to be per-form anyway; configure the field directly on each form).