How to collect file uploads with a form

A file upload field is the point where a form stops collecting answers and starts collecting documents: a CV, a receipt, an immunisation statement, a scanned passport. Documents carry more risk than answers, because they are harder to check, larger, and often full of personal information nobody asked for.

The short answer to collecting them safely has five parts. Allow only the file types you can open. Cap the number of files and their size at what the job needs. Tell people in one sentence what a good file looks like. Limit who can reach the form. And decide, before the first file arrives, how long you will keep it. GOV.UK’s design system adds a sixth that comes before all of them: only ask people to upload something if it is critical to delivering the service.

Allow only the types you can open

The file upload field has two type switches, images and PDF, and nothing else. There is no switch for Word documents, spreadsheets or archives, and arbitrary extensions cannot be added.

That sounds restrictive until you look at what the browser does on its own. MDN’s reference for file inputs is explicit that the accept attribute does not validate the types of selected files; it only hints to the browser which files to offer, a person can usually override it, and it must be backed by validation on the server. OWASP’s file upload cheat sheet starts from the same place: list the allowed extensions, only allow what the business actually needs, and validate the file type rather than trusting the type the file claims.

A short allowlist is the practical version of that advice. If you need a document, ask for a PDF and say so in the description. If you need a photo or a scan, switch on images.

The abstract submission form, built for a fictional coastal ecology congress, shows the pattern. Its only upload is optional, for figures, and the description sets every rule in one line: “Images and PDF only, up to two files, 2 MB each, at least 800 pixels on the short side. A table must be supplied as an image, not as text.” Note that the pixel minimum is a request, not a check. The file picker offers the types that are switched on, and the count and size are checked as files are added, but nothing measures pixels. Somebody on the committee still has to open the figure to see whether it is sharp.

Size and count caps

Maximum Files runs from 1 to 10, and Maximum File Size from 1 to 100 MB per file, starting at 10. One ceiling sits behind the setting: the upload service refuses any single file over 50 MB, so a field set to 80 still stops at 50. Both limits are checked while the person is uploading. A file over the limit is refused with a message naming the file, and choosing more files than the field has room for is refused with a message saying how many more it can take.

Set the count to the number of documents you asked for. The expense claim form allows up to ten receipts at 10 MB each, comfortably more than the six line items its table holds, and it tells people that a bigger claim goes in as two submissions. The internship application form goes the other way: the CV and the academic transcript are two separate required fields, each asking for one PDF. That costs one extra field and means the selection panel never has to open both files to find out which is which.

GOV.UK’s file upload guidance lists the exact wording for each failure, and it is worth copying into your descriptions so the rule is known before the error: “The selected file must be smaller than 2MB” and “You can only select up to 10 files at the same time”.

Naming and quality instructions

People rarely rename files, so do not rely on file names. Name the field instead, and use its description to say what a good file looks like and where to get it. The description is shown under a file upload field on a published classic form and under the question on a conversational one.

Three examples of descriptions that do real work:

• The expense claim form: “Photograph receipts flat on a dark surface with the whole docket in frame. A folded receipt with the total cropped off is the single most common reason a claim comes back.” It names the failure it is trying to prevent.
• The internship transcript: “An unofficial transcript downloaded from your student portal is fine at this stage.” It stops people waiting a week for an official copy nobody needs yet.
• The childcare enrolment form, for the immunisation history statement: “From myGov. Enrolment cannot be confirmed without it.” Where to find it, and why it is required, in nine words.

Security and privacy: what the form does and what stays with you

OWASP’s list of principles for secure upload reads, in short: allowlist extensions, validate type, set a file size limit, only allow authorised users to upload, store files away from the web server, and run files through antivirus or a sandbox where available.

The form covers part of that list for you. The file picker is limited to the types you switch on, the upload service turns away executable file extensions and file types outside its own list, every file has a size cap, and uploads go from the respondent’s browser straight to separate file storage rather than sitting on the page that served the form. Checking what actually arrived, and the two decisions below, stay with you.

Who can upload. A public link lets anyone who has it send you files. For identity documents, health records or payslips, choose an access type that matches: a secret key sent with the link, or login required with an allowlist of email addresses or a whole @domain for staff forms. A form with a key still accepts files from anyone the key is passed to, so for anything sensitive, login required is the stronger door.

How long you keep it. In Australia, APP 11 requires an organisation covered by the Privacy Act to take reasonable steps to protect personal information from misuse, interference and loss, and from unauthorised access, modification or disclosure. APP 11.2 adds that information no longer needed must be destroyed or de-identified, unless a law or court order requires it to be kept. A folder of scanned licences from a job that closed two years ago is exactly what that rule is about. Set a retention date, delete responses you no longer need from the responses table, and remember any copies staff downloaded. This is general information, not legal advice.

Where the files go

Knowing where a file lands decides how your team works with it.

• The responses table. A file upload cell shows how many files arrived and a View button that lists each file with a Download button. Opening one response lays it out like the form.
• The response PDF. Every uploaded PDF and image is appended to the response PDF as extra pages after the answers, which makes the PDF a single record of the submission with its evidence attached.
• The CSV export. Text only. It carries no files.
• Email alerts and webhooks. The email alert sends the answers to one address, and the webhook posts each submission once as JSON with no retry. Neither delivers the files as attachments.

If you are currently emailing out a PDF for people to fill in and upload back, the form’s own fields usually replace that round trip; the fillable PDF definition explains when a fillable PDF still earns its place.

The settings table

The table at the end of this article sets out ten decisions with a recommendation and the reason for each. Allowed File Types and Access type matter most, because they decide what can arrive and who can send it. The rest decide whether what arrives is usable.

Common mistakes

• One upload field for everything. A CV, a transcript and a reference letter in one field arrive as three unlabelled files. Give each document its own field.
• Promising a check the form does not make. A pixel minimum or “must be certified” is a request. Say who checks it and when.
• Requiring an upload people do not have yet. A required field blocks the whole submission. If a document can follow later, keep the field optional and say how to send it.
• Leaving a public link on a form that collects identity documents. Anyone who finds the link can upload.
• Treating downloads as safe. Open files on a device with current security software, and delete anything that does not match its field.
• Keeping every file forever. Set the retention date when you build the form, not when the storage bill arrives.

For the recruiting version of these decisions, including which documents to ask for at application stage, see job application form questions.

Build it

The online form with file upload page shows the field on finished forms, and the guide to viewing, exporting and managing responses covers opening and downloading what arrives. The builder has 41 component types. File Upload works in both classic and conversational forms and offers Maximum Files, Maximum File Size and the images and PDF switches; Photo Upload is the separate single image field for classic forms. Access is one of four types (public, secret key, login required, domain restricted), and the four add-ons are e-signing, webhooks, email alerts and a redirect after submit.