WordPress Plugin · Gravity Forms · v1.0.0 · Coming soon
Upload Vault
See exactly which Gravity Forms uploads a leaked URL exposes — then lock them down without breaking a single legitimate download.
- WordPress 6.2+
- PHP 7.4+
- GPLv2+
- Gravity Forms
- Verified, not assumed
Free core coming to the WordPress.org plugin directory. This page is the plugin’s official home.
Every CV, contract and ID scan ever uploaded through your forms is sitting at a URL. Who else has it?
Files uploaded through Gravity Forms land in a folder under your uploads directory, and on most servers anyone holding the URL can fetch them — no login, no questions. Those URLs leak constantly: forwarded notification emails, shared entry exports, analytics, browser histories, server logs. Upload Vault is built on one discipline most security plugins skip: it never assumes. It indexes every upload, asks your server — for real, over loopback — what an anonymous visitor would get, locks the folder down, and then proves the lock actually bites before it ever says the word “protected”.
How it works
Audit honestly, then lock down without breaking access.
Job one · The audit
Prove what a leaked URL actually exposes — never assume
Every file ever uploaded through your Gravity Forms lives in a guessable place, and anyone holding the URL can usually fetch it: CVs, contracts, medical intake forms, ID scans. Upload Vault indexes every upload, then does something unusual for a security plugin: it checks, over loopback, whether your server really serves them — and refuses to say “protected” until the server itself refuses the request.
- Exposed — the server served the file to an anonymous request. Confirmed, not guessed.
- Installed, unverified — rules written but the server still answered. Never reported as safe.
- Protected — the server refused. The only state that earns the word.
214 uploads are served to anonymous requests
3 forms · 9 folders · verified over loopback just now. “Protected” is only ever claimed after the server is observed refusing.
Folders
| 2026/07 · Careers form | Exposed 86 files · CVs, cover letters | |
| 2026/06 · Client intake | Exposed + listing browsable 128 files | |
| 2025/11 · Old NDA form (deleted) | Rules installed, unverified server still answering | |
| 2026/07 · Support attachments | Protected server refused · verified 12:41 |
Job two · The lockdown
Deny direct access, keep legitimate downloads working
Locking the folder is the easy half. The other half is that your team still needs the files: entry screens, notification emails, exported links. Upload Vault writes the deny rules, then serves every file through a capability-checked download proxy — logged-in, authorised users get the file; a leaked URL gets a login screen.
- Deny rules written for the Gravity Forms upload tree, removed cleanly on uninstall.
- A download proxy that checks capability, resolves real paths, and refuses traversal and PHP-family files outright.
- Entry links and notification emails rewritten to the proxy automatically.
Recent proxy decisions
| cv-daniela-m.pdf | Served · editor, via entry #1204 |
| contract-signed-04.pdf | refused logged-out request → login |
| ../wp-config.php | refused traversal attempt · logged |
Access control, not obscurity
Direct URLs stop working for strangers; entry screens and notification emails are rewritten to proxy links automatically, so your team never notices the lock.
Verified, not assumed
The status ladder is honest by construction: rules on disk mean nothing until the server is observed refusing a real request. A dead loopback reports impaired — never a false “protected”.
Defensive to Gravity Forms
Every Gravity Forms API call is double-guarded and falls back to the documented upload-path convention. If Gravity Forms changes, Upload Vault degrades gracefully — it cannot take your site down.
The proxy refuses first
Path traversal, PHP-family extensions, logged-out requests, unauthorised roles: refused before a byte is read. An authorise filter lets you veto downloads with your own logic on top.
In the free build
Complete for securing a site’s uploads.
Nothing below is limited, metered, or unlocked by payment.
-
Upload index
Every Gravity Forms upload found and catalogued — by form, folder and age — including uploads from forms you deleted years ago.
-
Exposure audit
Loopback-verified: the audit requests your own files anonymously and reports what the server actually did.
-
Browsable-listing detection
Catches the worse case — a folder that lists its contents to anyone who asks.
-
One-click lockdown
Deny rules written for the upload tree, verified after writing, removed on uninstall.
-
Capability-checked proxy
Files served through a logged-in, authorised, logged download route — with traversal and PHP-family requests refused.
-
Gravity Forms bridge
Entry screens and notification emails rewritten to proxy links automatically. Unknown URLs are left untouched.
-
New-exposure alerts
A scheduled re-check and an email the moment new exposed files appear.
-
Site Health integration
Exposure status surfaced in WordPress’s own Site Health screen — critical when files are confirmed exposed.
Free vs Pro
Pro is for when the uploads belong to clients.
The free build already audits and locks down a site completely. Pro adds the reach an agency needs: alert channels, longer retention, a fleet endpoint, and a report you can hand to the client.
| Capability | Free | Pro |
|---|---|---|
| Upload index across every form, current and deleted | ✓ | ✓ |
| Loopback-verified exposure audit with the honesty ladder | ✓ | ✓ |
| Deny rules + capability-checked download proxy | ✓ | ✓ |
| Entry-link and notification rewriting to the proxy | ✓ | ✓ |
| Scheduled re-check + new-exposure email | ✓ | ✓ |
| Site Health integration | ✓ | ✓ |
| Sites your licence covers | One, complete | 5 · unlimited on Agency |
| Slack & webhook alerts on new exposure | — | ✓ |
| Extended 90-day audit retention | — | ✓ |
| REST status endpoint for fleet dashboards | — | ✓ |
| White-label exposure report for clients | — | ✓ |
Pro · founder pricing
Pro
$99/yr
Agency
$249/yr
14-day trial, no card required. Annual, in US dollars. Pro is sold and licensed through Freemius, the merchant of record.
Questions people ask.
Doesn’t Gravity Forms already protect uploads?
Gravity Forms stores uploads in a semi-random path, which is obscurity, not access control. If someone has the URL — from a forwarded email, a shared entry export, a browser history, a log file — the server typically serves the file to anyone. Upload Vault replaces “hopefully nobody finds it” with a verified deny and a permission-checked proxy.
What does “verified” mean exactly?
After writing deny rules, Upload Vault requests one of your own uploaded files over loopback, anonymously, and looks at what the server does. Only a refusal earns the “protected” status. Rules that exist but don’t bite — common on nginx, where .htaccess is ignored — are reported as “installed, unverified” with an explanation, never as safe.
I’m on nginx — do the deny rules work?
nginx ignores .htaccess, and Upload Vault will tell you exactly that: the audit will show rules installed but the server still serving, with the nginx configuration you need to add shown on screen. It never pretends the rules worked.
Will old entry links and emails keep working?
Yes — the Gravity Forms bridge rewrites entry-screen links and notification emails to the proxy automatically, so authorised people keep one-click access to every file. URLs it does not recognise are left untouched.
Can it break my site if Gravity Forms updates?
Every Gravity Forms call is wrapped in existence checks with a documented-convention fallback. Worst case, Upload Vault loses some enrichment until an update — it has no fatal path tied to Gravity Forms internals.
What does uninstalling remove?
The deny rules it wrote, its index table, options and schedules. Your files are never touched — Upload Vault never moves, renames or deletes an upload.
What did your forms collect this year?
Job applications. Signed contracts. Intake forms. If any of those URLs ever left the building, Upload Vault will tell you — with proof — whether they open.