Should you add a file upload field to your landing page form?

A recruitment form with no way to attach a resume, a tradesperson's quote form with no way to attach a photo of the job site, a training funding application with no supporting document: in several of the industries this blog covers, a plain text form isn't enough. Something is missing — a document, a piece of proof — and the question comes up: should you add a file upload field to your landing page form? The answer depends on three things that are rarely addressed together: what it costs in conversions, what security risk it opens up, and what it implies under GDPR the moment a personal file — resume, ID document, a photo of a private location — passes through your server.

Which forms actually need a file field

A file field is only justified when the document is working data, not a "just in case" extra. Four cases come up repeatedly:

• Recruitment — a recruitment landing page with no way to attach a resume forces candidates to write a wall of text into a generic "message" field, or reply by email: here the file field is the working data, exactly like a phone number is for a broker.
• Quotes with photos — a quote request form for a tradesperson gains enormously from accepting one or two photos of the job site: the quote sent back is more accurate, and the visitor immediately sees the point of the request.
• Funding applications — a training course eligible for public funding, or a grant application, sometimes requires a supporting document (proof of unemployment status, ID): better to collect it at the right point in the journey than to discover it's needed at signature time.
• Applications and briefs — a creative brief, a portfolio, an entry for a contest or a grant: the file is the expected deliverable, not an option.

Outside these cases, resist the temptation. A file field bolted onto a generic contact form "to be thorough" improves nothing and costs a lot in conversions, for reasons that are as much about ergonomics as about the psychology of disclosure.

What it costs in conversions

On mobile as much as desktop, asking for a file adds a break the other fields don't have: the visitor has to leave the flow, find the document on their device — or worse, photograph it on the spot — then come back to the form. This break in intent is one of the most documented causes of abandonment on multi-step forms: every trip away from the form is a chance to never come back. The general rule we detail in how many fields to convert applies here even more forcefully than elsewhere: a file field has to earn its keep, in processing quality, far beyond what it costs in volume.

What research says about disclosing personal documents

A study by Kim, Duong, and Xiong published in 2026 in the Journal of Information & Knowledge Management ("A Career-Oriented Information Disclosure on Professional Networking Sites: Privacy Calculus and Regulatory Focus Perspectives") shows, among job seekers, that the decision to disclose career-related information follows an explicit trade-off between perceived utility and perceived risk: the clearer the utility of disclosing, the more willing the candidate is to do it; the higher the perceived risk — toward the recruiter as much as toward the platform itself — the less they disclose. A resume file structurally reveals more than a text field: address, photo, career gaps, sometimes affiliations. A file field therefore inherits all the perceived risk of a phone or email field, in a denser form. The practical consequence is direct: the line of microcopy under the field ("Used only to review your application, never shared with a third party") isn't cosmetic — it changes the decision mechanics the study identifies.

Securing an upload field: what breaks if you improvise

A study by Wichmann, Groddeck, and Federrath presented in 2022 at the ARES conference (International Conference on Availability, Reliability and Security) — "FileUploadChecker: Detecting and Sanitizing Malicious File Uploads in Web Applications at the Request Level" — explains why validating a received file by its extension alone, or by the MIME type declared by the browser, stays insufficient: both pieces of information are supplied by the client, so they can be forged, letting through files whose actual content doesn't match what they claim to be. The authors propose a request-level check, independent of the application's own code, to catch this kind of file before it reaches storage. Three rules apply whatever your stack: validate the file's real content server-side, enforce an explicit maximum size, and never store or serve the file from a directory capable of executing code.

How to implement it cleanly in Next.js

For a file of a few hundred kilobytes (a resume, a compressed photo), a Server Action that receives the FormData and forwards the file to object storage (S3, Cloudflare R2) works fine. Beyond a few megabytes, prefer a direct upload from the browser to storage via a signed URL generated by your backend: the file no longer passes through your serverless function, which avoids hitting the size and execution-time limits of platforms like Vercel. Either way, generate a random file name server-side — never keep the original name as-is, it can contain problematic characters or paths — and associate it with the form submission rather than a predictable public URL.

GDPR: a resume isn't data like any other

A resume or supporting document bundles several pieces of personal data into a single file, sometimes more sensitive than every other form field combined: identity, photo, career history, sometimes indirectly information touching on special categories (a career gap, an association membership mentioned in the activities section). The principles detailed in our guide to GDPR-compliant forms apply with heightened rigor: a precise purpose, access restricted to only the people processing the application, and a retention period that doesn't exceed what the processing requires — a resume that wasn't retained generally has no reason to stay stored beyond a few months. Also avoid the reflex of forwarding every received file by unencrypted email to a whole team: a restricted-access link to storage is safer and easier to purge.

Cutting friction without giving up the file

• Make the field optional when you can — for recruitment, for instance, accept the application without a resume and offer to send it by email afterward: the same logic as required and optional fields in general.
• Offer a no-file alternative — a field that reads "or paste your LinkedIn profile link" captures the visitors who don't have their resume on hand.
• State the constraints before the click — accepted formats and maximum size shown under the field, not discovered after a rejection; a clear error message follows the same rules as our piece on form error messages.
• Enable photo capture on mobile — the capture attribute on a field with accept="image/*" opens the camera directly for a job-site photo, skipping the gallery.

In practice on your landing page

In the ten LanderKit templates (€89 each, €229 for the bundle), the form is a self-contained component: adding an optional file field with its reassurance microcopy takes nothing away from the rest of the page. It's especially relevant on a document-driven template like Formation CPF, where a supporting document speeds up funding processing, or on Agence locale, where a photo attached to the quote form turns a vague request into a workable file from the very first exchange.