--- title: "File Upload Security for Real Estate Agent Inquiry Forms" description: "Decide whether your inquiry form needs attachments. Specify validation, malware review, private access, retention, and evidence before accepting uploads." canonical: "https://scalewithsearch.com/articles/secure-file-uploads-agent-inquiry-forms" --- ## Site navigation - [Scale With Search](https://scalewithsearch.com/) - Services - Services - [AI systems](https://scalewithsearch.com/ai-systems) - [Site build](https://scalewithsearch.com/work#site-build) - [Whole website fix](https://scalewithsearch.com/work#whole-website-fix) - [Content library with SEO](https://scalewithsearch.com/work#content-library) - [Working session](https://scalewithsearch.com/audit) - Start here - [Send your brief](https://scalewithsearch.com/work#send-your-brief) - [Example scope](https://scalewithsearch.com/work#review-the-example-scope) - [Prices and terms](https://scalewithsearch.com/work#prices-and-terms) - Industries - Real estate - [Real estate agents and teams](https://scalewithsearch.com/for/real-estate) - [Platforms, ownership, and IDX](https://scalewithsearch.com/for/real-estate/real-estate-website-platforms-ownership-idx) - [Search, content, and AI](https://scalewithsearch.com/for/real-estate/real-estate-search-content-ai) - [Inquiries, campaigns, and handoffs](https://scalewithsearch.com/for/real-estate/real-estate-website-inquiries-campaigns-handoffs) - [Buyer, seller, and local pages](https://scalewithsearch.com/for/real-estate/real-estate-buyer-seller-local-resources) - [Rules, privacy, and trust](https://scalewithsearch.com/for/real-estate/real-estate-website-rules-privacy-trust) - Browse by business - [Trades and home services](https://scalewithsearch.com/for/#group-trades) - [Health, wellness, and animal care](https://scalewithsearch.com/for/#group-practices) - [Law, finance, and IT](https://scalewithsearch.com/for/#group-professional) - [Marketing and SEO agencies](https://scalewithsearch.com/for/#group-agencies) - [Shops and manufacturers](https://scalewithsearch.com/for/#group-manufacturing) - [Restaurants, shops, studios, and nonprofits](https://scalewithsearch.com/for/#group-local-services) - Chiropractic practices - [Chiropractic and wellness practices](https://scalewithsearch.com/for/chiropractic-and-wellness-practices) - [Chiropractic and physical therapy clinics](https://scalewithsearch.com/for/chiropractic-and-physical-therapy-clinics) - [All industries](https://scalewithsearch.com/for/) - Resources - Free tools - [AI readiness check](https://scalewithsearch.com/check) - [Free tools](https://scalewithsearch.com/tools/) - [Free Starter Kit](https://scalewithsearch.com/kit/business-memory-starter-kit.zip) - Guides - [AI-native library](https://scalewithsearch.com/ai-native) - [Industry intelligence](https://scalewithsearch.com/intelligence) - [Office job guides](https://scalewithsearch.com/guides/) - [Business memory](https://scalewithsearch.com/articles/business-memory-for-ai-agents-guide) - [Agent governance](https://scalewithsearch.com/articles/ai-agent-governance-guide-small-business) - [Migration and ownership](https://scalewithsearch.com/articles/leaving-vendor-ai-memory-guide) - Articles - [All articles](https://scalewithsearch.com/articles/) - [What changed](https://scalewithsearch.com/changes/) - About - Evidence - [Proof](https://scalewithsearch.com/proof) - Scale With Search - [About](https://scalewithsearch.com/about) - [How it works](https://scalewithsearch.com/how-it-works) # File upload security for real estate inquiry forms Keep attachments off your initial buyer or seller inquiry form unless you have an approved reason to collect them. For a necessary upload, require file validation, malware review, restricted storage, named access, and a disposal procedure before publication. The FTC recommends collecting only information your business needs and keeping it only while a business reason remains. Apply that principle before adding a document field. [FTC guidance for businesses, checked 2026.10.14](https://www.ftc.gov/business-guidance/resources/protecting-personal-information-guide-business). The brief below contains recommended requirements for your website builder and brokerage reviewer. The vendor examples identify questions to resolve in your actual configuration. They do not establish that an upload route passes a security review. ## Decide whether the attachment belongs in the inquiry Write the buyer or seller question the attachment helps answer. Consider whether a written description or public property link is sufficient. Keep the ordinary contact route available when a file is unnecessary. For a seller asking about preparing a property, begin with their question and usable reply details. Consider a photo only when your brokerage approves its purpose and handling. For a buyer requesting a consultation, leave financial records outside the initial form. Keep bank statements, tax returns, identification documents, and private transaction records in the responsible professional's approved exchange process. Treat this as a collection recommendation. Have your broker approve the boundary for your business. For lender-directed preparation, use the separate [mortgage document checklist](/articles/mortgage-preapproval-document-checklist-agent-page). It briefs the lender handoff. This article addresses the technical handling of an attachment your business has approved collecting. Complete this proposed collection brief before selecting a tool: | Decision | What to record | | --- | --- | | Purpose | The specific question the file helps the receiving agent answer | | Permitted material | Approved document or image categories and information visitors must omit | | Collection route | Public inquiry, authenticated follow-up, or another approved professional's destination | | Responsible people | Collection approver, technical maintainer, recipient, and backup | | Storage and copies | Initial store, review service, integrations, notifications, exports, and backups | | End of use | Approved retention trigger, disposal procedure, and any preservation exception | If the collection purpose or responsible recipient remains unresolved, leave the upload out of the website brief. ## Require validation before a file becomes usable OWASP recommends a narrow extension allowlist, file-type and signature checks, generated storage names, size limits, and storage outside the public website directory. It warns that a submitted Content-Type header is untrustworthy. No individual check provides complete protection. [OWASP File Upload Cheat Sheet, checked 2026.10.14](https://cheatsheetseries.owasp.org/cheatsheets/File_Upload_Cheat_Sheet.html). Ask the builder to translate those requirements into your selected provider's supported controls. Require current vendor documentation for each setting and limit. Record the documentation date, installed version where relevant, and actual configuration. Approve the permitted file types and size ceiling from the business need and documented capability. Request evidence of server-side enforcement. Keep a visible field restriction separate from that evidence. For an image request, decide which approved image formats are necessary. Leave archives and unrelated document categories outside the proposed allowance. Ask the maintainer to explain any requested exception before accepting it. Require the implementation record to identify what happens to a rejected file. Include temporary storage and any processing that occurs before rejection. Mark an unsupported control unresolved rather than inferring it from the upload button. ## Specify malware review and failure handling OWASP recommends antivirus or sandbox inspection where available and content disarm and reconstruction where appropriate. It also warns about information leakage through public scanning services. [OWASP file-content guidance, checked 2026.10.14](https://cheatsheetseries.owasp.org/cheatsheets/File_Upload_Cheat_Sheet.html). Ask the technical owner to propose a documented review process. Specify that unreviewed material stays unavailable to ordinary recipients. Require the owner to explain how this restriction is enforced. | Condition to resolve | Requirement to put in the brief | | --- | --- | | File awaiting inspection | Identify its temporary location and people permitted to access it | | Review service unavailable | Define whether collection stops or material remains isolated pending review | | File rejected | Specify removal or restricted preservation under the approved procedure | | Review accepted | Release only to the approved destination and recipient | | File cannot be assessed | Assign a decision owner and an alternative inquiry route | These are proposed operating conditions, not a claim that either vendor below supplies a scanning service. Obtain the selected review provider's current documentation before commissioning that connection. ## Check download access separately from upload acceptance OWASP distinguishes verifying identity from granting permission to a particular resource. It recommends denying access by default and checking authorization on every request, including static resources. [OWASP authorization guidance, checked 2026.10.14](https://cheatsheetseries.owasp.org/cheatsheets/Authorization_Cheat_Sheet.html). Define who may upload, read, download, forward, and delete a file. Give the receiving agent only the access their task requires. Record how access ends after a staff or vendor change. Require a direct-file test as well as a page test. Open the test file's address while signed out. Repeat with an unrelated test account where the system supports accounts. Require both results to match the approved permission rules. Use synthetic material and accounts you control. Ask the builder to test another inquiry's file boundary in an agreed environment. Keep the actual private URLs out of shared screenshots and ordinary repair notes. ### Webflow: inspect the restriction and every connection Webflow documents file URLs in submission notification emails. Its file-upload guide says switching off **Restrict uploaded file access** allows anyone with the link to access the file. The guide also says transferring form uploads through third-party integrations requires switching that restriction off. [Webflow form file upload, updated 2026.05.13; checked 2026.10.14](https://help.webflow.com/hc/en-us/articles/33961307228947-Form-file-upload). Have the maintainer demonstrate the actual restriction before accepting an external transfer. If the proposed connection requires broader access than your brief permits, choose another approved design. Webflow distinguishes restricted form uploads from assets in its Assets panel or Collection fields. Those assets are publicly available. Deleting an asset from the site does not automatically remove its CDN copy. [Webflow asset privacy, updated 2026.09.07; checked 2026.10.14](https://help.webflow.com/hc/en-us/articles/33961281837843-Asset-privacy). Keep a private inquiry attachment out of the public asset library. Require the maintainer to identify the actual storage path and removal procedure. ### Gravity Forms: confirm the download permission implementation Gravity Forms documents obscured download URLs by default. It identifies `gform_require_login_pre_download` for requiring login and `gform_permission_granted_pre_download` for custom access checks. These are developer filters, not proof that your installation has the required restrictions. [Gravity Forms File Upload Security, modified 2026.05.21; checked 2026.10.14](https://docs.gravityforms.com/file-upload-security/). Ask the developer to show the configured permission rule and the direct-file test. Require them to distinguish login from permission to the specific attachment. Gravity Forms also states that entry data is not encrypted and advises against storing highly sensitive information such as passwords or credit-card details. [Gravity Forms Security Best Practices, checked 2026.10.14](https://docs.gravityforms.com/security/). Have the reviewer assess the complete information flow before approving collection. Neither example establishes a preferred vendor. Evaluate the configuration against the same collection, access, review, and disposal requirements. ## Map visitor data and approve its disposal The form tool and connected services may process visitor data. Webflow's documentation describes storing submitted files and distributing their links through notifications. [Webflow upload handling, checked 2026.10.14](https://help.webflow.com/hc/en-us/articles/33961307228947-Form-file-upload). Map each destination before approving the route. Include the original file, metadata, review service, receiving account, and any copied attachment. Ask which information appears in notifications and technical logs. Use the [privacy applicability guide](/articles/ccpa-applicability-agent-website) and [inquiry retention schedule](/articles/website-lead-retention-schedule-agent) to prepare the review. Have counsel determine applicable privacy and preservation duties. Avoid adopting a universal retention period for buyer and seller uploads. The FTC recommends a written retention policy stating what to keep, how to protect it, how long to retain it, and secure disposal. [FTC information-protection guidance, checked 2026.10.14](https://www.ftc.gov/business-guidance/resources/protecting-personal-information-guide-business). The FTC also recommends encrypting sensitive information in transit and in storage. [FTC electronic-security guidance, checked 2026.10.14](https://www.ftc.gov/business-guidance/resources/protecting-personal-information-guide-business). Ask the maintainer to document both protections for each destination. Assign a disposal owner for every identified store. Request evidence for deletion, scheduled expiry, and backup treatment separately. Keep any destination the provider cannot account for marked unresolved. - [Gravity Forms webhook: connect your agent website to its CRM](/articles/gravity-forms-webhook-agent-crm-handoff) ## Accept the attachment and the inquiry as separate checks Arrange a demonstration with synthetic files and contact details you control. Have the technical owner supply safe fixtures for rejection tests. Keep malware and real client records out of the demonstration. Use this proposed acceptance sheet. Verify supported behavior and visitor messages against the selected provider's dated documentation before testing. | Test | Evidence to request | | --- | --- | | Inquiry without an unnecessary attachment | The ordinary contact route remains usable | | Approved harmless file | Matching file reaches the authorized destination after the required review | | Disallowed type or file beyond the approved limit | Documented rejection, with its storage treatment confirmed | | Upload or review interruption | Observed behavior matches the approved failure procedure | | Direct-file address while signed out or using an unrelated account | Access matches the permission brief | | Recipient notification | Intended person receives the buyer or seller question and can find the approved file | | Disposal of the synthetic record | Each identified copy follows the approved procedure; exceptions remain visible | Record the page, test date, expected result, observed result, and responsible reviewer. Save access evidence separately from proof of inquiry receipt. A received notification does not close an unresolved file-access check. These are checks to commission. No attachment handling or inquiry delivery on your website has been verified by this article. ## Bring the upload decision into your website brief Supply the inquiry page, collection purpose, approved file categories, recipient, storage requirements, and unresolved controls. Ask for a written decision on whether attachments belong in that path. The [Scale With Search $2,000 whole website fix](/for/real-estate) includes inquiry-path repair with a test inquiry and proof of receipt at the agreed destination. [Published scope, checked 2026.10.14](https://scalewithsearch.com/work). Confirm any proposed upload handling, restricted storage, scanning connection, or disposal work in the written scope before treating it as included. - [Test the seller inquiry path on your real estate website](/articles/seller-inquiry-path-agent-website) - [Check your real estate website in 30 minutes](/articles/real-estate-website-audit) - [Own your real estate website: domain, hosting, editing, and leads](/articles/own-your-site) ## Related: Real estate - [Test the seller inquiry path on your real estate website](/articles/seller-inquiry-path-agent-website) - [Check your real estate website in 30 minutes](/articles/real-estate-website-audit) - [Own your real estate website: domain, hosting, editing, and leads](/articles/own-your-site) ---- ```text .|########||. .|########||. .|########||. |##||. .||##|. |##||. .||##|. |##||. .||##|. |#|. .|#|. |#|. .|#|. |#|. .|#|. |#| |#| |#| |#| |#| |#| .#| |#. .#| |#. .#| |#. .#. .#| .#. .#| .#. .#| |#. .#| |#. .#| |#. .#| |# ...... #| |# ...... #| |# ...... #| .# ||#########| #| .# ||#########| #| .# ||#########| #| .#. |######||######|. .#. .#. |######||######|. .#. .#. |######||######|. .#. #. .##|###|##|#|######| .# #. .##|###|##|#|######| .# #. .##|###|##|#|######| .# || |##|#||||||||||||#||#| || || |##|#||||||||||||#||#| || || |##|#||||||||||||#||#| || # |#||||||||||||||||||||#| #. # |#||||||||||||||||||||#| #. # |#||||||||||||||||||||#| #. || |#||||||||||||||||||||||#| || || |#||||||||||||||||||||||#| || || |#||||||||||||||||||||||#| || # .#||||||||||||||||||||||||#| # # .#||||||||||||||||||||||||#| # # .#||||||||||||||||||||||||#| # || ....|||#||||||##|#|||#|#||##||||....|. || || ....|||#||||||##|#|||#|#||##||||....|. || || ....|||#||||||##|#|||#|#||##||||....|. || #. . ....|# ....#||| ||| .#||| ....#. .# #. . ....|# ....#||| ||| .#||| ....#. .# #. . ....|# ....#||| ||| .#||| ....#. .# # . ||||#| .#####|| . .#| .#||| ||||# #. # . ||||#| .#####|| . .#| .#||| ||||# #. # . ||||#| .#####|| . .#| .#||| ||||# #. .| ||||| #. |#|||||. || #. |#||. .||||| || .| ||||| #. |#|||||. || #. |#||. .||||| || .| ||||| #. |#|||||. || #. |#||. .||||| || || |.... #. ....|#. |. ...|. ....|| || || |.... #. ....|#. |. ...|. ....|| || || |.... #. ....|#. |. ...|. ....|| || #. .||||||##||||||##||####|||||||#||||||#| .# #. .||||||##||||||##||####|||||||#||||||#| .# #. .||||||##||||||##||####|||||||#||||||#| .# # .||####|###########################|. # # .||####|###########################|. # # .||####|###########################|. # # .#||||||.#.|| # |. ..# #| #|||||#| # # .#||||||.#.|| # |. ..# #| #|||||#| # # .#||||||.#.|| # |. ..# #| #|||||#| # # .#|||||| .. |# ## |#| ...#|#|||#| # # .#|||||| .. |# ## |#| ...#|#|||#| # # .#|||||| .. |# ## |#| ...#|#|||#| # # .#|||#|# .# .#| #| ##|.#..#|||||#| # # .#|||#|# .# .#| #| ##|.#..#|||||#| # # .#|||#|# .# .#| #| ##|.#..#|||||#| # # .#||||||############|######|||||#| # # .#||||||############|######|||||#| # # .#||||||############|######|||||#| # # |...||#||||||#||||#|#||||||#|||||#||| |.| # # |...||#||||||#||||#|#||||||#|||||#||| |.| # # |...||#||||||#||||#|#||||||#|||||#||| |.| # #. .. ||||# .|||##|. |#| .|| || .|||#. #| # .# #. .. ||||# .|||##|. |#| .|| || .|||#. #| # .# #. .. ||||# .|||##|. |#| .|| || .|||#. #| # .# || | ...|| ...##| | #| .|. |. ##### .. .| || || | ...|| ...##| | #| .|. |. ##### .. .| || || | ...|| ...##| | #| .|. |. ##### .. .| || || ||||| || ||||#| . |. |. |#. ||||| |#| || || || ||||| || ||||#| . |. |. |#. ||||| |#| || || || ||||| || ||||#| . |. |. |#. ||||| |#| || || .# |.....#|....|#.||||.|||##.|#|....||.#||.#. #. .# |.....#|....|#.||||.|||##.|#|....||.#||.#. #. .# |.....#|....|#.||||.|||##.|#|....||.#||.#. #. #.|||||||#############################| ||| .# #.|||||||#############################| ||| .# #.|||||||#############################| ||| .# || ##||#||#||||||#||#||#||#||##. || || ##||#||#||||||#||#||#||#||##. || || ##||#||#||||||#||#||#||#||##. || # .#|||||||||#||#|||||||||||#| # # .#|||||||||#||#|||||||||||#| # # .#|||||||||#||#|||||||||||#| # || |#||||||||||||||||||||||#| || || |#||||||||||||||||||||||#| || || |#||||||||||||||||||||||#| || .# |#||||||||||||||||||||#| #. .# |#||||||||||||||||||||#| #. .# |#||||||||||||||||||||#| #. || |#||||||||||||||||||#| || || |#||||||||||||||||||#| || || |#||||||||||||||||||#| || #. .######|#|#########| .# #. .######|#|#########| .# #. .######|#|#########| .# .#. |#####||||#####| .#. .#. |#####||||#####| .#. .#. |#####||||#####| .#. |# ||########|| #. |# ||########|| #. |# ||########|| #. |# ...... #| |# ...... #| |# ...... #| |#. .#| |#. .#| |#. .#| |#. .#. |#. .#. |#. .#. .#| |#. .#| |#. .#| |#. |#| |#| |#| |#| |#| |#| .|#|. .|#|. .|#|. .|#|. .|#|. .|#|. |##||. .||##| |##||. .||##| |##||. .||##| .||########||. .||########||. .||########||. Scale With Search 2026 [scalewithsearch.com](https://scalewithsearch.com) ```