Write clear instructions for file uploads

Describe the useful material

Use a specific label such as Screenshot of the problem rather than Attachment. Add a short instruction describing the part of the page or document the team needs. For an accessibility report, the person may be unable to capture an image, so keep a written account usable on its own whenever possible.

Ask people to remove unrelated information before uploading. A screenshot of a browser window can include account details or other open tabs that do not help explain the issue. The instruction should be specific to the task, without asking for more proof than the team needs to begin investigating.

Make the instructions match the settings

Choose the formats appropriate to the request. An image request and a document request need different instructions. In Accessible Forms Pro, supported types are PDF, JPEG, PNG and plain text. Select the subset the team needs rather than advertising unsupported office documents, archives or video files.

Pro supports a configured limit from 1 to 10 MB per field, with a default of 2 MB. Server limits can be lower. A submission is also limited to three files and 10 MB in total. Check the limits displayed on your actual form and test near them before publishing copy that promises a particular allowance.

Help someone recover from a rejected file

Test a permitted file, a file over the limit, an empty file and an unsupported type. The person needs enough information to choose another file or continue without it when optional. Changing a filename from one extension to another does not convert the underlying document.

Try the file picker on a phone as well as a desktop. Check the selected filename and the result of correcting another question after selection. In Accessible Forms Pro, visitors must select attachments again after a server-side error or when returning to saved progress. Explain this in the form's instructions.

Prepare the team's review process

OWASP recommends multiple controls around uploads, including permitted file types, size limits and controlled access. Its guidance does not make an allowed extension a guarantee that a document is harmless. Decide who reviews incoming files and how the team handles unfamiliar content before collecting it.

Pro stores attachments privately with entries outside the public media library. An authorized entry manager can download a quarantined file for review and approve it; approval does not publish a public download link. Authorized entry readers can download approved files. This is a permission and review workflow, not a claim of automatic antivirus scanning.

Using Accessible Forms

Use an upload for supporting material that the team has a clear reason and process to review.

In Free: Free can collect a written description and a relevant page URL without an attachment.

With Pro: Private file-upload fields require Pro. File checks inspect content as well as the extension; private attachments follow the entry's deletion and personal-data cleanup. Copies downloaded or backed up elsewhere need their own handling process.