Secure uploads and manage advanced entry controls

Choose single or multiple uploads

File upload and Multiple files are included in Drecha Forms Free. Use File upload when exactly one attachment is expected. Use Multiple files when a visitor may attach several related documents.

1. Add File upload or Multiple files from the Advanced group.
2. Write a label that explains what to upload.
3. Enable Required field only when the workflow cannot proceed without a file.
4. Open Validation.
5. Set Maximum size per file from 1 through 25 MB.
6. For Multiple files, set Maximum files from 1 through 10.
7. Enter the allowed extensions separated by commas.
8. Add a Custom error message and save.

The supported extension allowlist is JPG, JPEG, PNG, GIF, WebP, PDF, TXT, CSV, DOC, DOCX, XLS, XLSX, and ZIP. If no supported value remains after saving, the plugin falls back to JPG, JPEG, PNG, and PDF.

Understand private storage checks

Drecha Forms does not place uploaded responses in a public media URL. It requires an absolute, writable directory outside the public document root. A host can define DRECHA_FORMS_PRIVATE_DIR when the safe default location is not suitable.

For every file, the plugin:

1. Confirms that PHP received a genuine upload.
2. Rejects empty files and files over the configured limit.
3. Checks the extension against the form allowlist and a separate executable-file blocklist.
4. Uses WordPress to verify that the file contents and MIME type match the extension.
5. Replaces the stored filename with a 48-character random name.
6. Stores the original display name and metadata separately.
7. Attaches the file record to the entry only when the entry transaction succeeds.

An upload is cleaned up if later form validation fails. Scheduled maintenance also removes stale pending files.

Download an uploaded file

1. Open Drecha Forms > Entries.
2. Open the entry containing the attachment.
3. Find the file under the submitted response.
4. Use its private download action while signed in with the Drecha Forms management capability.

The download checks both the entry reference and file reference, requires an authorized WordPress session and nonce, sends X-Content-Type-Options: nosniff, and downloads the original safe filename. A random path alone is never treated as access control.

Configure local spam scoring

Open Form settings > Storage & spam and set Spam threshold from 20 through 100. Lower values are stricter. Start with the default of 60, review real results, and adjust gradually.

Public protection also includes a honeypot, signed form token, same-origin check when the browser supplies an Origin header, request-size limit, throttling, and idempotency protection. The local score considers signals such as an unrealistically fast submission, a missing browser user agent, excessive links, and common spam phrases. No external spam account is required.

An entry at or above the threshold is stored with Spam status and does not queue email or Pro integrations. This preserves evidence for review without sending suspicious data onward.

Use entry statuses and private notes

Entries can be Unread, Read, Spam, or Erased. Opening an Unread entry marks it Read. Use the status controls to return it to Unread or classify it as Spam.

Erased is produced by the WordPress personal-data erasure workflow. That workflow nulls matching declared personal fields, clears source and address-derived data, removes private files, notes, email logs, integration logs, and related queued jobs.

Use a private administrative note for follow-up that must not be sent to the respondent. A note accepts up to 5,000 characters and records its administrator and timestamp.

Delete entries safely

Individual and bulk delete actions require the Drecha Forms management capability. Bulk requests accept at most 100 unique entries at a time.

After confirmation, deletion removes the entry, notes, mail and integration logs, queued jobs, and associated private files. This cannot be undone. Export required records before deleting them.

Retention performs the same cleanup for entries older than the form's configured number of days. Daily maintenance deletes in bounded batches; a Retention period of 0 leaves deletion to an administrator or privacy request.

Free and Pro differences

Single and multiple uploads, private storage, MIME verification, authorized downloads, local spam protection, status management, notes, retention, privacy erasure, and confirmed individual or bulk deletion are Free.

Pro automation jobs are removed with their entry. Disabling Pro does not make Free uploads public or hide stored entries. Advanced submission-management products beyond these shipped controls are not currently available.

Troubleshoot uploads and entry controls

The form reports that private storage is unsafe

Ask the host for an absolute writable directory outside the public document root and define it as DRECHA_FORMS_PRIVATE_DIR. Do not point it at WordPress uploads or another web-accessible folder.

A permitted filename is rejected

The detected MIME type may not match the extension, the file may be empty, or the server upload limit may be lower than the field limit. Renaming a file does not change its real type.

Legitimate entries are marked as spam

Review the content and timing, then raise the form's Spam threshold gradually. Do not remove the honeypot, signed token, or rate limit.

A deleted upload cannot be recovered

Permanent entry deletion also deletes associated files. Restore it only from a complete, access-controlled backup made before deletion.