How to accept file uploads on an HTML form, safely

This post is part of our How to series on getting more from your htmlhost site. Every feature it mentions is documented in the docs.

Job applications need a CV. Quote requests are easier with a photo. Support tickets want a screenshot. With htmlhost Pro, your forms can accept files, and we handle the parts that usually make uploads risky.

Add a file field

1. In the editor, open Library → Elements → Forms.
2. Drag File Upload inside your form. The form is set up for files automatically.
3. Publish.

Visitors can attach up to 3 files, 10 MB each (25 MB per message).

Where the files go

Open the message on your site's Messages tab. Attachments are listed with their size and a Download button. Notification emails list the file names but never attach the files, so nothing risky lands directly in your inbox.

What we do to keep it safe

• Only useful file types: images, PDFs, Office documents, text and CSV.
• Checked by content, not just name. A program renamed to photo.png is refused, and so are formats that can carry scripts (like SVG or HTML), archives and executables.
• Private storage. Uploaded files are never published on your site. Download links are yours only and expire after 15 minutes.
• Always a download. Files open as downloads, never in the browser, so a malicious document can't run as part of a web page.

Even so, files come from strangers. Only open the ones you expect.

Limits

File uploads are part of Pro, with up to 2 GB of attachments a month per account. On Free, forms work normally but won't accept attachments; visitors see a clear message instead.

More in the file upload docs.