A Gravity Forms file upload can be secure at submit time but still leak through email notifications, public URLs, long-lived download links, backups, exports, or staff sharing. Audit the download path, not only the field settings.
Use this for sites that collect resumes, contracts, intake documents, photos, applications, IDs, medical forms, or other sensitive files through Gravity Forms.
Quick answer
Gravity Forms File Upload Private Download Link Audit should be handled with a narrow evidence-first workflow: inventory upload fields, test link access, review notifications, then verify the result before making broader changes.
What to check first
- List every form with File Upload fields, accepted file types, max size, multi-file setting, and storage location.
- Test whether uploaded file URLs are public, private, signed, expiring, or protected by WordPress permissions.
- Review notification emails, confirmations, CRM notes, entry exports, and backup jobs for file links.
- Check whether off-server storage such as S3 uses private access and lifecycle rules.
- Define retention and deletion rules for entries, files, backups, and exports.
Diagnostic table
Use this table to keep the work practical. It connects the symptom to evidence and a verification step.
| Action | Evidence to collect | How to verify |
|---|
| Inventory upload fields | List every form with File Upload fields, accepted file types, max size, multi-file setting, and storage location. | Sensitive uploads are not reachable by unauthenticated public URL unless intentionally public. |
| Test link access | Test whether uploaded file URLs are public, private, signed, expiring, or protected by WordPress permissions. | Notification and confirmation links follow the intended access policy. |
| Review notifications | Review notification emails, confirmations, CRM notes, entry exports, and backup jobs for file links. | Backups and exports do not retain files beyond the business requirement. |
| Audit backups | Check whether off-server storage such as S3 uses private access and lifecycle rules. | Storage and lifecycle rules are documented for each upload form. |
Why this usually happens
- A private upload can become public when a notification email includes a direct file URL.
- Backups and exports can preserve sensitive uploads after entries are deleted.
- Staff may forward long-lived links outside intended access groups.
- S3 or CDN storage can accidentally make uploaded files public.
Field notes
- Test with harmless sample files that look like the real workflow but contain no private data.
- Retention policy belongs in the same audit as access policy.
Useful command or data shape
Adapt paths, IDs, and privacy handling to the site before running commands or storing data on production.
wp gf form list
wp gf form get 7 --format=json | jq '.. | objects | select(.type? == "fileupload")'
find wp-content/uploads/gravity_forms -type f -mtime -30 | head -30
curl -sSI 'https://example.com/path/to/uploaded-file.pdf'
# Check notification links, entry exports, backup scope, and S3 access.
Safe fix order
Do the work in a sequence that makes each result easy to prove. Stop if a step produces new evidence that changes the incident scope.
- Inventory upload fields
- Test link access
- Review notifications
- Audit backups
- Set retention rules
What to tell the client or owner
Tell the owner which forms collect sensitive files, who can access them, and when those files are removed.
Production verification checklist
- Sensitive uploads are not reachable by unauthenticated public URL unless intentionally public.
- Notification and confirmation links follow the intended access policy.
- Backups and exports do not retain files beyond the business requirement.
- Storage and lifecycle rules are documented for each upload form.
Mistakes to avoid
- Do not judge the fix by one browser or the homepage only.
- Do not delete evidence before recording usernames, file paths, timestamps, and response headers.
- Do not add a cache, security, or tracking plugin while the original problem is still unclear.
- Do not leave test users, temporary debug logs, or broad API keys active after verification.
When HandL WP should help
Bring in help when this affects leads, checkout, search visibility, malware risk, paid media reporting, or a client production site. HandL WP can trace the issue through WordPress, hosting, cache, tracking, and Search Console, then verify the workflow after the technical fix.
If this is active on a production site, audit Gravity Forms upload security.
Related HandL WP guides
Use these related guides when the same issue touches tracking, security, checkout, or crawler visibility.
Helpful references