How to Create a File Upload Form in WordPress

You can create a file upload form in WordPress for free with Contact Form 7 or Forminator. Both include a file field in their free versions, and both let you limit the file types and the file size.

We tested this in October 2026 on a WordPress 7.1.3 test site. We built a form in each plugin and sent the wrong files through it. We also opened the builders of two other form plugins to see whether their file upload field is free.

This guide shows which plugins really include the field. It then sets up a WordPress form with file upload in two of them. After that it explains where the files end up, how to keep uploads safe and how to fix common problems.

Which Free Plugins Include a File Upload Field?

Contact Form 7 and Forminator include a file upload field in their free versions. WPForms Lite and Fluent Forms Free do not. In our test the field was locked in both of those builders. A WordPress file upload plugin search should start with the first two.

Here is what each builder showed on our WordPress 7.1.3 test site, using the free versions available in October 2026.

Plugin and version	File upload in the free version	What we saw
Contact Form 7 6.2.2	Yes	A file tag in the tag generator
Forminator 1.58.2	Yes	A File Upload field in the field list
Fluent Forms 6.2.15	No	File Upload and Image Upload are grayed out
WPForms Lite 2.0.2.2	No	An upgrade prompt when you click the field

The old advice to install WPForms and add its File Upload field only works with a paid license. WPForms Lite shows the field but stops you with a message when you click it.

Fluent Forms Free is similar. Its field list shows File Upload and Image Upload in gray, and the buttons are disabled in the builder.

We did not buy a Pro license for either plugin. We cannot tell you how their paid upload fields behave. Both Pro versions may be a good fit if you already use those plugins for other forms.

Which File Upload Plugin Should You Choose?

Choose Contact Form 7 when an emailed attachment is enough and choose Forminator when you want the file kept on your site. Both are free. The decision depends on where you need the file after the visitor submits the form.

Use these points to decide:

• Contact Form 7: You want files in your inbox, such as resumes, screenshots or signed forms. You are happy to edit a short line of form code, and you do not need to browse files inside WordPress.
• Forminator: You want a visual builder, a single or multiple file type, and files kept in a folder on your site. You also want to see who sent each file next to the form fields.
• A paid plan of a plugin you already use: You build every other form in WPForms or Fluent Forms and want one tool. We did not test their Pro upload fields.

Neither free plugin is a document management tool. If you need approvals, versions or customer accounts, look at the order-based option near the end of this guide.

Method 1: Create a File Upload Form in WordPress With Contact Form 7

You can create a file upload form in WordPress with Contact Form 7 in six short steps. Add a file tag, set the allowed types and the size limit, and attach the file to the email. Then put the shortcode on a page.

The Contact Form 7 file upload field is free, but the plugin does not store the file in WordPress. It sends the file to you as an email attachment, which suits job applications and support requests.

1. Install the plugin: Go to Plugins > Add Plugin and search for Contact Form 7. Install and activate it. The plugin adds a Contact menu to the dashboard.
2. Open a form: Click Contact > Contact Forms and edit the sample form or use Add Contact Form. The editor shows a row of tag buttons above the form code.
3. Generate the file tag: Click the file button. Tick the required checkbox if you need a file. Then fill in Acceptable file types as pdf|jpg|png and File size limit as 2mb.
   
4. Insert the tag into the form: Click Insert Tag and add a label around it. The finished line looks like the example below. Save the form.
5. Attach the file to the email: Open the Mail tab and type [upload-file] into the File attachments box. Without this step the visitor’s file never reaches your inbox.
   
6. Add the form to a page: Copy the shortcode from the form editor, paste it into a page, and publish the page.

Here is the form code from our test. The tag line is the one the generator wrote:

<label> Your resume (PDF, JPG or PNG, 2 MB maximum)
    [file* upload-file filetypes:pdf|jpg|png limit:2mb] </label>

If you leave the options out, the plugin applies its own defaults. The Contact Form 7 source code accepts audio, video and image files by default, and the size limit defaults to 1 MB. Set both options on every upload field so that you choose the limits yourself.

Tip: Test the whole path. Submit a good file and check that the email arrives with the attachment.

Now test the form with files that should fail. A .php file was rejected under the field with “You are not allowed to upload files of this type”. It is not in the allowed list.

A 3 MB PDF against the 2 MB limit gave “The uploaded file is too large” in the same place.

Method 2: Create a File Upload Form in WordPress With Forminator

You can create a file upload form in WordPress with Forminator by adding its File Upload field to a form. Choose single or multiple files, pick the allowed types, set a size limit, and embed the form with a block or shortcode. It also stores the files on your site.

Forminator Free (version 1.58.2 on our test site) lists File Upload in its field picker without a Pro badge. Only the E-Signature field carried one.

1. Install the plugin: Go to Plugins > Add Plugin and search for Forminator. Install and activate it. A Forminator menu appears in the dashboard.
2. Start a form: Open Forminator > Forms and click Add New to start a form. Add a Name or Email field first with Insert Form Fields. That way you know who sent the file.
3. Add the File Upload field: Click Insert Form Fields again and choose File Upload. The field is available without a Pro license.
   
4. Choose single or multiple files: Open the field settings with the gear icon. The first tab lets you switch the type between Single and Multiple.
5. Set the file types and size: Open the Settings tab. Under Allowed filetypes you can keep WordPress’ default list or switch to Specific filetypes. Under Filesize limit you can set a limit that is lower than the server limit.
   
6. Publish and embed the form: Use Publish Changes. Then copy the shortcode from the Forms list with Copy Shortcode and paste it into a page.

Choose Multiple on the first tab if visitors need to send several files. The plugin’s code can then cap the number of files. It shows the message “You can upload a maximum of N files” when a visitor goes over.

Forminator blocks risky types by default. Its settings screen lists the extensions that stay disabled, including .php, .exe, .html, .js and .svg. The plugin’s source code uses the same list when it filters the allowed types.

We tested the front-end form with two files. A .php file was rejected with “Error saving form. Uploaded file extension is not allowed”.

Then we renamed a PDF to disguised.jpg, which is the kind of file that slips through an extension check. Forminator rejected that file as well, with “Sorry, you are not allowed to upload this file type”. Its upload field code checks the real type of the file with the WordPress function wp_check_filetype_and_ext, and not only the name.

Note: We could not finish a full successful submission in our test environment. The storage details in the next section come from the plugin’s code and not from a live entry.

Where Do Uploaded Files Go in WordPress?

Each plugin stores uploads differently. Contact Form 7 attaches the file to an email and then deletes its temporary copy. Forminator saves the file in a folder inside wp-content/uploads and can also add it to the Media Library, when you turn that option on.

Contact Form 7 first moves the file into a temporary folder named wpcf7_uploads in your uploads directory. The plugin’s file handling code places it in a random subfolder and writes a deny-all .htaccess file for Apache. It also makes the file readable only by its owner, and a cleanup function removes files older than 60 seconds.

That behavior means Contact Form 7 does not keep applications for you. If the email does not arrive, the file is gone. Keep a copy by saving the attachment from the email, or add a plugin that stores form entries.

Forminator keeps the file. Its code saves uploads under wp-content/uploads/forminator in a folder named with the form ID and a hash. It also adds an index file unless you turn that off.

An option to add uploads to the Media Library is off by default.

Leave that setting off for private documents. Files in the Media Library are easier to find by URL and appear next to your public images.

How to Keep a File Upload Form Secure

A safe upload form allows only the file types you need and caps the size. It checks the real file type, keeps files out of public folders and gives them a safe name. Test the form with a wrong file before you publish it.

The OWASP File Upload Cheat Sheet is the standard reference. It says to list allowed extensions and to validate the file type instead of trusting the Content-Type header, because that header can be spoofed.

It also recommends that the application generates the filename. Store files outside the webroot, set a size limit, and run files through antivirus or a sandbox.

Here is how our two methods line up against those checks:

• Allowed types: Both plugins let you list the extensions you accept. Both rejected a .php file in our test.
• Content check: Forminator rejected a PDF renamed to .jpg. Contact Form 7 accepted the same file at the form stage. Rely on a short allowlist, and open any attachment only after you check it.
• Size limit: Set it in the tag or the field. The PHP manual says upload_max_filesize sets the maximum size of an uploaded file and that post_max_size must be larger than it.
• Storage: Contact Form 7 deletes its temporary copy quickly. Forminator keeps files in a form folder. Protect that folder and leave the Media Library option off for private files.

Spam bots also find forms with file fields. Add a spam challenge to any public upload form. Cloudflare Turnstile is one option.

Warning: Never allow executable file types such as .php, .exe, .js or .html in an upload field, and never accept “all files”. One visitor with the wrong file can compromise a site that stores uploads in a public folder.

How to Write the Upload Field So Visitors Get It Right

Visitors fail an upload form when the rules are hidden. Put the accepted file types and the size limit in the label, and mark the field required only when you need the file. A clear label cuts the errors that reach your inbox.

Our test form used the label “Your resume (PDF, JPG or PNG, 2 MB maximum)”. The same limits sit in the tag. The label and the check always agree.

Add a fallback line for files over the limit, such as an email address for large files. Then add a confirmation message that says when a person will hear back. If the files hold personal data, such as resumes or IDs, say who can see them and how long you keep them.

How to Fix Common File Upload Form Problems

Most upload problems come from three places: the limit in the plugin, the limit in PHP and the mail setup. Check them in that order. Use a small PDF for the first test to keep a size limit from hiding a different fault.

• File too large: The plugin limit and the server limit both apply. The PHP manual says post_max_size must be larger than upload_max_filesize. Raise both if you need big files.
• File type not allowed: In Contact Form 7 the extension must appear in the filetypes option. In Forminator the default list blocks risky extensions such as .php. Switch to Specific filetypes only for types that are safe.
• Email without the attachment: In Contact Form 7 the File attachments box on the Mail tab must contain the field name in square brackets. Our form used [upload-file].
• File missing later: Contact Form 7 deletes its temporary copy after about a minute. Save the attachment from the email.

Test again after every change, and use a form with a single file field first. Add other fields once the upload works.

Can You Create a File Upload Form in WordPress Without a Plugin?

Yes, but you must write the code yourself, and the work goes beyond the upload. WordPress handles an upload that you pass to it, while the form, the checks, the spam protection and the notifications are all yours. A form plugin is the safer choice for most sites.

The WordPress function reference describes wp_handle_upload as the function that handles PHP uploads in WordPress. Its options let you choose the allowed mime types and whether to test the mime type of the file.

A hand-written form also needs a nonce check, a capability decision, a size limit and a storage plan. We did not build or test such a form, because Contact Form 7 and Forminator already do these jobs and are free.

Our guide to a WordPress contact form without a plugin covers the plain form. Add upload handling only if you can review the code for security.

What About Files That Belong to a WooCommerce Order?

A form plugin saves a file with a form entry and has no order to attach it to. If a customer must attach a document to an order, such as a prescription, use a tool built for orders. Our WooCommerce Medical Prescription Attachment plugin adds an upload box to the cart and checkout pages.

The upload box also appears on the order received and view order pages. You review each upload from the order edit screen and mark it approved or rejected, and both outcomes email the customer. This fits pharmacies and any store that needs a document before it ships. Our review of prescription plugins compares it with other options.

For other stores, a form on a contact page is enough. See how to check form submissions in WordPress and how to get notifications on form submissions once your form is live.

Conclusion

The easiest way to create a file upload form in WordPress for free is Contact Form 7 or Forminator. Use Contact Form 7 when an emailed attachment is enough. Use Forminator when you want the file kept on your site.

Whichever you choose, list the file types you accept, set a size limit and test with a wrong file. Then check that the file reaches you before you publish the page.

Frequently Asked Questions (FAQs)