Upload settings

Every media field has settings that control what can be uploaded through it and where the files go.

File types and sizes

• Allowed MIME types restricts which kinds of file the field accepts, such as image/jpeg and image/png. Leave it empty to accept every type of that kind that WordPress allows.
• A Files field accepts documents too, such as application/pdf.
• Max file size (KB) limits each file.
• Max total size (KB), on multi-file fields, limits all files combined.

These rules apply when files are added through the field. They don't reach back into the media library: tightening them later doesn't remove anything already selected, but the next save reports anything that no longer meets them.

Custom upload directory

Custom upload directory puts files uploaded through this field in a folder of their own under wp-content/uploads, for example menus or menus/2026. Use letters, numbers, hyphens, underscores and dots, with / between folders.

Absolute paths, .. and backslashes are refused when you save the fieldset. Files always stay inside the uploads folder.

Private uploads

Private uploads is for files that shouldn't be listed publicly, like proofs or unreleased artwork. Files uploaded through the field:

• get a long, random file name that can't be guessed
• go to the vx-framework/private folder, unless you set a custom directory
• are marked private in the media library
• are left out of the public REST API for visitors who can't access them

Warning

Private uploads hide files; they don't lock them. The web server still delivers the file to anyone who has its exact address. Don't use private uploads for data that must never leak, such as identity documents or medical records, unless your server also blocks direct access to the upload folder.

Technical details for LLMs

• Keys: allowed_mime_types (string[]), max_file_size_kb (int ≥ 1), max_total_size_kb (multi), min_files, max_files, private_upload (bool), upload_dir (≤ 180 chars, regex ^(?:[A-Za-z0-9_-][A-Za-z0-9._-]*(?:/[A-Za-z0-9_-][A-Za-z0-9._-]*)*/?)?$).
• Hard errors on save (value dropped): Invalid file value., Attachment not found., File type is not allowed., File extension is blocked.. Size/count limits are warnings.
• Private uploads: 24-character random basename, post_status = private, directory vx-framework/private by default. There's no filesystem enforcement (no .htaccess, no gated serving endpoint).
• Filters: vxframework/fieldsets/media/pre_upload, vxframework/fieldsets/media/scan_result, vxframework/fieldsets/files/pre_upload, vxframework/fieldsets/files/scan_result; actions vxframework/fieldsets/media/post_upload, vxframework/fieldsets/files/post_upload.