Building forms

File uploads

Private storage, file checks, size limits, links in emails, attachments and the Media Library.

Add a File upload field (Advanced group). Visitors can drop files on the field or choose them with a button. Each file uploads as soon as it is chosen, with a progress bar and a percentage that screen readers can follow, so a large file does not delay the final Send.

Settings

Under Allowed file types, buttons add or remove a whole group at once: images, documents, spreadsheets, presentations, archives, audio and video. Hover a button to see its file types.

If the connection drops while a file is uploading, the file shows Try ... again, and the visitor can send it again without choosing it a second time. A file that arrives twice (for example after a retry) is stored once.

The largest upload your server accepts is shown in Forms, Diagnostics. If it is lower than the field's limit, ask your host to raise upload_max_filesize and post_max_size.

Checks on every file

• The extension must be in the field's list. Scripts, web pages and other executable types are never accepted, even if you add them to the list, and names such as photo.php.jpg are refused.
• The file's content must match its extension: a renamed program does not pass as a PDF.
• Images must be readable images.
• The size and number limits are checked again on the server.

Files that were uploaded but never sent with a form are removed after 24 hours.

To protect the server, one visitor address can upload 40 files a minute, and the files added to one submission can be 256 MB together. Developers can change both with the flvf_upload_rate and flvf_max_submission_bytes filters (see Hooks).

Where files are stored

Files go into a private folder, wp-content/uploads/flavonto-forms-private/, under random names. The plugin protects the folder from direct download and tests that protection over the web (Diagnostics shows the result). Some servers, often Nginx, ignore the protection files; when the test shows the folder can be reached, new files are stored encrypted so a downloaded copy is unreadable.

For the strongest separation, keep files outside the website folder by adding this to wp-config.php (the folder must exist and be writable by PHP):

define( 'FLVF_PRIVATE_DIR', '/home/youraccount/flavonto-forms-files/' );

Opening files

• In the dashboard, files open through a signed link for people allowed to see the entry.
• In emails, {all_fields} and field tags include signed links that work for 7 days by default. In Settings, Files you can change the number of days or require logging in to open them.
• Attach to notification emails attaches the files instead. Mail services refuse large attachments (often over 10 to 25 MB in total), so links are the safer default.
• When Store in entries is off for the field, the files are kept only until the emails are sent, encrypted while they wait, and then deleted.
• Also add to the Media Library copies the file into the Media Library, where it becomes public. Use it only for files meant to be published, such as photos for a gallery. File name in the Media Library can use merge tags, for example {entry:reference}-{field:name}; the copy goes into the usual year and month folder. The private copy keeps its random name and fixed folder, so a path can never be steered by an answer.

Deleting

Files are deleted with their entry when the entry is deleted permanently, and with the entry's other answers when an entry is anonymised by a retention rule or a personal data erasure request.