Sample form with uploads and redirect

Use this pattern for a customer-facing enquiry, application, or support page when you need one uploaded file and a calm hand-off to a thank-you page.

Superfunky's core form inbox accepts structured JSON submissions. Keep file handling in your companion plugin, custom integration, or server workflow; do not send raw multipart uploads directly to the public JSON endpoint.

Recommended flow

1. Build the page in WordPress with a Custom HTML block.
2. Add a small Shortcode block only where you want a simple reusable element, such as

for a separate consent capture.

1. Collect the file in your upload step first.
2. Validate extension, size, and MIME type; scan the file; and store it outside the web

root or with execution disabled.

1. Submit the remaining form fields to POST /wp-json/funkycommerce/v1/form-submissions.
2. On success, return 303 See Other or send the browser to a thank-you page with

window.location.replace().

Example form

<form id="sample-application" method="post" data-success-url="/thank-you/">
  <input type="hidden" name="formId" value="sample-application">
  <input type="hidden" name="formName" value="Sample application form">
  <input type="hidden" name="source" value="https://shop.example.com/apply/">
  <input type="hidden" name="language" value="en">
  <input type="hidden" name="website" value="">

  <label>
    Name
    <input name="name" autocomplete="name" required>
  </label>

  <label>
    Email
    <input name="email" type="email" autocomplete="email" required>
  </label>

  <label>
    Attachment
    <input name="attachment" type="file" accept=".pdf,.png,.jpg,.jpeg">
  </label>

  <label>
    Notes
    <textarea name="notes" rows="5"></textarea>
  </label>

  <button type="submit">Send application</button>
</form>

Security notes

• keep the honeypot field empty;
• only accept the file types you need;
• enforce a hard size limit;
• quarantine or scan uploads before storage;
• keep upload execution disabled at the web server;
• escape every customer-supplied value before showing it back to the visitor;
• keep rate limiting, spam checks, and HTTPS enabled.

If you only need a simple opt-in, use the built-in

shortcode. For broader submission inbox guidance, see Forms and autoresponders and Security.

Next: push notifications.