Gravity Forms file uploads can sit in WordPress uploads, email inboxes, CRM records, helpdesk tickets, object storage, and backups. A useful retention schedule tracks every copy, not only the original upload folder.
Use this for quote forms, job applications, medical or legal intake, warranty claims, support attachments, design files, and any form that accepts documents or images.
Quick answer
Gravity Forms Uploaded File Retention Schedule should be handled with a narrow evidence-first workflow: inventory upload fields, map file copies, set retention rules, then verify the result before making broader changes.
What to check first
- List each form with a file upload field, accepted file types, max file size, and business reason for collection.
- Map every storage location: WordPress uploads, notifications, CRM, S3, support desk, exports, and backups.
- Assign a retention period by form purpose, compliance need, customer expectation, and dispute window.
- Add deletion evidence that includes entry ID, file path, storage system, deletion date, and owner.
- Test whether backups or email notifications keep copies longer than the main WordPress file.
Diagnostic table
Use this table to keep the work practical. It connects the symptom to evidence and a verification step.
| Action | Evidence to collect | How to verify |
|---|---|---|
| Inventory upload fields | List each form with a file upload field, accepted file types, max file size, and business reason for collection. | Every upload field has a business purpose and retention owner. |
| Map file copies | Map every storage location: WordPress uploads, notifications, CRM, S3, support desk, exports, and backups. | Each storage location has a matching keep, delete, or archive rule. |
| Set retention rules | Assign a retention period by form purpose, compliance need, customer expectation, and dispute window. | A test deletion removes the intended copy without breaking entry history. |
| Add deletion evidence | Add deletion evidence that includes entry ID, file path, storage system, deletion date, and owner. | The retention schedule names the backup window and exception process. |
Why this usually happens
- Teams remove old entries from WordPress but forget email attachments and CRM copies.
- Uploads are moved to S3 without a matching lifecycle rule or access review.
- Backups keep deleted files for months, which may be correct, but the owner does not know the window.
- The form asks for files that the business no longer needs to process the request.
Field notes
- Do not promise automatic deletion unless every copy is covered. Say exactly which systems are included.
- For sensitive uploads, make private storage and signed access the default rather than relying on obscure public URLs.
Useful command or data shape
Adapt paths, IDs, and privacy handling to the site before running commands or storing data on production.
retention_rule:
form: job-application
field: resume_upload
primary_storage: wp-content/uploads/gravity_forms/
copied_to: [hr_email, crm_attachment, daily_backup]
retention: 180_days_after_position_close
deletion_evidence: entry_id, file_url, deleted_at, owner
Safe fix order
Do the work in a sequence that makes each result easy to prove. Stop if a step produces new evidence that changes the incident scope.
- Inventory upload fields
- Map file copies
- Set retention rules
- Add deletion evidence
- Review backups
What to tell the client or owner
Send the owner the file map, retention period, deletion owner, and any systems that need separate legal or privacy approval.
Production verification checklist
- Every upload field has a business purpose and retention owner.
- Each storage location has a matching keep, delete, or archive rule.
- A test deletion removes the intended copy without breaking entry history.
- The retention schedule names the backup window and exception process.
Mistakes to avoid
- Do not judge the fix by one browser or the homepage only.
- Do not delete evidence before recording usernames, file paths, timestamps, and response headers.
- Do not add a cache, security, or tracking plugin while the original problem is still unclear.
- Do not leave test users, temporary debug logs, or broad API keys active after verification.
When HandL WP should help
Bring in help when this affects leads, checkout, search visibility, malware risk, paid media reporting, or a client production site. HandL WP can trace the issue through WordPress, hosting, cache, tracking, and Search Console, then verify the workflow after the technical fix.
If this is active on a production site, audit WordPress upload retention and access.
Related HandL WP guides
Use these related guides when the same issue touches tracking, security, checkout, or crawler visibility.
- Gravity Forms file upload private storage S3 policy
- Gravity Forms file upload security quarantine checklist
- Gravity Forms REST API vendor offboarding checklist