Accept file uploads on WordPress forms

The problem

You need a résumé, PDF, or image with the lead—and you do not want files sitting in the Media Library or attached to every notification email.

The solution

Add a File upload field (one file per field). Visitors pick a file on the front end; Sobi Forms stores it privately and shows a download link in the inbox. Emails mention the filename and link to the inbox—they do not attach the binary.

How to set it up

Open the form in the builder.
Add a File upload field.
Choose allowed extensions (searchable multi-select) and a max size (default 5 MB, capped by the server upload_max_filesize / post_max_size).
Under After submit, keep Save to inbox enabled—file fields require inbox storage.
Save and embed the form.

You can add several file fields on the same form (e.g. CV + portfolio PDF).

Where files are stored

Files live under:

wp-content/uploads/sobiforms/

They are not added to the Media Library. On Apache, Sobi Forms adds deny rules via .htaccess. On Nginx, block public web access yourself:

location ^~ /wp-content/uploads/sobiforms/ {
    deny all;
    return 403;
}

Admins download files from Sobi Forms → Submissions (capability-checked URLs).

Security notes

Server-side checks: MIME type, getimagesize() for images, and a blocklist of dangerous extensions (SVG is not allowed as an image upload).
Spam submissions do not get normal delivery; treat quarantine accordingly in the inbox.

Tips