Secure file uploads for contact and consultation forms

Set a narrow acceptance policy

Define allowed formats and size limits around the actual business need. OWASP recommends layered validation rather than trusting browser-provided type information. PDF and image support should not imply that every file with those extensions is safe.

Separate storage from public delivery

Keep uploads outside publicly served directories and apply access controls to retrieval. Use a generated storage identifier. A date, company and email can help an authorized operator search a private index without exposing those details in public URLs.

Plan failed email handling

Give each submission a reference and record its attachment status. The operational question is not only whether the email was sent, but whether staff can find the right record without opening unrelated customer files. Agree a retention process before accumulating attachments.

Practical checklist

• Enforce format and size checks on the server.
• Keep attachments private.
• Link records through a submission ID.
• Define access and deletion responsibilities.

A common question

Should the uploaded file be public so staff can download it?

No. Use an authenticated retrieval process or another approved private channel. A hard-to-guess public URL is not the same as access control.