How it works
Accept a defined set of file types
Upload fields support PDF, JPEG, PNG and text files. Checks examine file content rather than trusting the filename alone.
- Explain which supporting file the visitor should provide
- Use only the supported document and image formats
- Test valid files and rejected types before publication
Keep uploads out of the public media library
Attachments are stored privately in the WordPress database with the entry. They are quarantined until an authorized reviewer approves them.
- Entry access permissions also matter for attachment access
- Files do not become ordinary public media URLs
- Downloads use restrictive response headers
Include files in the privacy lifecycle
Attachments follow the entry's deletion and personal-data cleanup rather than becoming a separate public archive. Team access restrictions remain relevant throughout review and follow-up.
- Ask for only the material the task needs
- Review retention before collecting documents
- Use controlled sample attachments for staging and demonstrations
Collect a supporting screenshot
An accessibility report may need an image that helps the reviewer understand a barrier.
Explain what to attach
Ask for a screenshot of the issue and remind the visitor to remove unrelated personal information.
Review the submission
An authorized team member opens the entry and reviews the quarantined attachment.
Apply the right lifecycle
Keep access and retention appropriate to the report, then remove the entry and attachment when no longer needed.
An example workflow. Configure and test it in your own WordPress site.
Free and Pro for this workflow
Feature reference: Free 1.4.0 and Pro 1.3.2. Check published downloads for the version you can install.
Included in Free
- A full contact form without attachment fields
- Private entry access and retention controls
- Core entry deletion and WordPress personal-data tools
With Pro
- PDF, JPEG, PNG and text upload fields
- Content checks, private database storage and quarantine
- Reviewer approval within the submission workflow
Plan your setup
- Approval is a human review step, not a malware scan or a guarantee that a file is safe.
- Private storage does not replace secure site administration, backups or an appropriate collection policy.
- When Pro is inactive, upload configuration is retained but the upload field is not displayed.
Common questions
Are attachments public WordPress media items?
No. The plugin stores them privately with the submission outside the media library.
Can I accept any file extension?
The supported formats are PDF, JPEG, PNG and text. Do not describe the upload field as unrestricted file hosting.