Accept only the file types you need, limit their size, rename them on arrival, and store them where the web server cannot run them or show them publicly. Then keep the form's software updated.

A form that accepts anything

A quote form with a box for photographs. A careers page that takes resumes. A form where customers send drawings, artwork or plans.

Each one lets a stranger put a file onto your web server, or into your inbox, without anyone checking it first.

Most of what arrives is exactly what you asked for. Upload forms are still a well-known way into a small business site, because some of what arrives is not.

They are worth having. They are also worth setting up with some care.

What can go wrong

The first is the most serious. If a file containing code reaches a folder where the server runs code, whoever uploaded it can run their own commands on your site.

From there, a site can end up serving spam, phishing pages or hidden scripts without the owner seeing anything change.

Accept only what you need

Decide which file types each form actually needs. A renovation quote form needs photographs, usually JPEG and PNG, and perhaps PDF. A careers form needs PDF and Word documents.

Refuse everything else, and make the check on the server, not only in the visitor's browser, where it is easy to get around.

The check should look at what each file actually is, not just the end of its name. A file called photo.jpg.php is not a photograph, whatever the first part of its name says.

Some types need extra care. SVG images can contain scripts, so a form that accepts logos in that format should never display them back on the site unprocessed.

Limit size and number

Set a maximum size per file and a maximum number of files per submission.

Phone photographs are often several megabytes each, so the limit needs room for a few of those. It does not need room for a gigabyte.

State the limits beside the upload box, before anyone tries, and show a clear message when a file is too large. A form that fails silently loses the enquiry along with the file.

Rename and store them safely

Rename every file on arrival to a random name chosen by the site, keeping only an approved extension. That stops a file's own name from deciding how the server treats it.

Store uploads outside the public part of the website where possible, or in a folder set so the server will never run anything in it and will not list its contents.

Staff should reach the files through a login, not a public address that anyone could guess or a search engine could find.

If you do not know where your form puts files, ask whoever maintains the site. The answer is often a surprise.

Opening files in the office

The risk does not end at the server. Someone in the office will open each file.

A resume that asks the reader to enable editing or enable content to view it properly is a warning sign. Genuine resumes do not need macros to be read.

Keep office computers and their antivirus updated, open unexpected documents in a viewer rather than editing software where possible, and ask staff to check before enabling anything.

A worked example

A sign and vehicle wrap shop in an industrial park took artwork through its website: logos, drawings, and photographs of vehicles to be wrapped.

The form accepted any file of any size and saved everything into a folder inside the public website, under the customers' original file names.

During a routine check, the host's malware scan flagged a file in that folder. It was named like an image but contained code, and nobody could say whether it had ever been run.

The same folder could be listed in a browser, showing five years of customer logos and draft designs, some for businesses that had not yet opened.

The site was cleaned and checked first. The form now accepts only PDF, EPS, JPEG, PNG and Illustrator files, up to a stated size, with a file transfer link offered for anything larger.

Files are renamed on arrival and stored outside the public site. Staff open them through a login, and each job's files are deleted a set time after it is invoiced.

The form's plugin went onto the monthly update list with everything else.

Keeping the form maintained

Many upload problems come from the form software, not its settings. Form and upload plugins have had flaws that let attackers upload files the settings were supposed to refuse.

The fixes arrive quietly, as ordinary updates. A form plugin that has not been updated for a year may be carrying a hole that attackers already know about.

Add protection against automated submissions as well, so a script cannot send files to the form thousands of times.

How long to keep them

Uploads are often personal information: resumes, photographs of people's homes, plans with addresses on them.

Set a retention period for each kind of upload, then delete the files when it ends, from the server and from inboxes. Five years of resumes in a folder helps nobody.

From November 1, businesses under federal privacy law have to log every breach involving personal information and report the serious ones. Fewer stored files means less that can be breached.

The counter-case

Not every form needs an upload box.

If photographs help with a quote but are not essential, customers can reply to your confirmation email with them, which keeps their files off the web server entirely.

A business that rarely receives files may be better without the feature than with one nobody maintains.

Where uploads genuinely help, keep them: limit what is accepted, store it safely, and keep the form updated.

The check

  1. List every form that accepts files.
  2. Restrict each one to the types it needs.
  3. Set size limits and state them.
  4. Move stored uploads out of public folders.
  5. Rename files on arrival.
  6. Delete old uploads on a schedule.
  7. Update the form software every month.

Step four is the one most often found wrong, because the default on many sites is an uploads folder inside the public website that anyone with the address can open.

What a hidden script does once it is on a site is covered in cryptomining scripts on hacked websites.

Frequently asked questions

Why are upload forms a security risk?

They let strangers put files onto your server. A script disguised as an image can take over the site if it lands where the server will run it.

Which file types should a form accept?

Only what it needs, such as JPEG, PNG and PDF for quote photographs. Check on the server what each file actually is, not just its name.

Where should uploaded files be stored?

Outside the public website, or in a folder where nothing can run and the contents cannot be listed. Staff should reach them through a login.

Why rename files when they arrive?

So a file's own name cannot decide how the server treats it. A random name with an approved extension removes tricks like photo.jpg.php.

How long should uploads be kept?

Until the job or hiring decision is finished. Resumes and photographs of homes are personal information, and an old folder of them is a liability if the site is compromised.

Does the form software need updating?

Yes. Upload plugins have had flaws that bypass their own settings, and the fixes arrive as ordinary updates. An unmaintained form can carry a known hole.

West Coast Media Solutions Inc. provides web design, web development, hosting, digital marketing, and business consulting to organisations across Canada, drawing on more than twenty-five years in the field.

Upload form nobody has checked since launch?

Send us the address of the form. We will check where the files go and who can reach them.

Start a Conversation