A WordPress job application form is easy to build and hard to run. Any form builder will collect a name, an email and a file. What it won’t do is keep that resume private, tell the candidate when you’ve shortlisted them, or let you pull one job’s applicants into a spreadsheet without digging through a mixed pile of entries.
That gap is the real question behind most searches for a job application form: do you need a form builder, or do you need a job board that treats an application as its own record? This guide walks through what an application should capture and how each piece should behave once someone hits Submit.
Form builder or job board?
A form builder treats every submission the same. A contact form, a quote request and a job application all end up as rows in one entries table, and the “job” they belong to is a hidden field you added yourself.
That works for one role. It stops working around the second. You can’t give a hiring manager access to only their own applicants. The candidate has no place to see what happened to their application. Resumes sit in the media library unless you’ve gone out of your way to hide them.
A job board plugin flips the model. The application belongs to a specific job, to a candidate (or a guest), and to an employer who’s allowed to see it. Everything else follows from that. If you’re running more than a role or two, that’s the better starting point, and our WordPress job board plugin page shows what comes built in.
What an application should capture
Less than you think. Every extra required field costs you applicants.
The baseline is a name, an email, a resume file and an optional cover letter. In WP Career Board that’s what the apply form collects out of the box: the candidate uploads a PDF, DOC or DOCX and can add a note. A logged-in candidate’s name and email come from their account.
Where it gets useful is role-specific questions. “Do you have the right to work in this country?” or “Link your portfolio” belongs on a designer’s form and not on a warehouse one. Custom application questions come from the field builder in WP Career Board Pro, and required questions are enforced on the server, so a request that skips the browser can’t skip the question either. The answers are saved with the application and show up in your CSV export.
Resume uploads that stay private
This is where a generic form usually fails. Upload a resume through a typical form plugin and the file lands in wp-content/uploads with a guessable address. Anyone with the link can open it.
WP Career Board does two things differently. Resume files are stored in a separate private folder under uploads, inside a randomly named subfolder, and the attachment is marked private. Nobody gets a direct file address. The download link goes through the plugin, which checks who’s asking first.
Access is limited to a short list:
- The candidate who uploaded the file.
- The employer who owns the job, and members of that employer’s company.
- Site administrators and job moderators.
Everyone else gets a “file not found” page. There’s a filter if you need to widen that for a special case, but the default is closed.
Two practical notes. The folder is hidden from the web with server rules, and nginx doesn’t read those. The plugin adds a check to Site Health that tells you if your server still serves the folder directly, and gives you the one-line nginx rule to fix it. Run that check once after launch.
The other note is size. The maximum resume size is a setting, 5 MB by default, adjustable from 1 to 20 MB. Accepted types are PDF, DOC and DOCX, and anything else is rejected with a clear message.
Guest applications or accounts?
Making people register before applying costs you candidates. Not requiring it costs you a bit of tidiness. You choose.
Guest applications are on by default. A guest enters a name and an email, attaches the resume and applies. To switch to account-only, turn on the “require login to apply” option in the Career Board settings.
Guests get some guardrails. The same email can’t apply to the same job twice within 24 hours, and applications from one IP address are capped at ten an hour, which matters because each one can carry an upload.
What a guest doesn’t get is the candidate dashboard, because there’s no account behind it. They do still get status emails, which brings us to the part most form plugins skip.
Statuses the candidate actually sees
An application has a status, and the status changes. WP Career Board gives employers five to choose from: Submitted, Reviewing, Shortlisted, Rejected and Hired. The employer changes it from their dashboard and can add a note.
The candidate side is the point. Each change emails the candidate, guest or member, using templates you can edit. Rejections go out as their own, gentler message. And candidates don’t read the harsh word: where an employer sees “Rejected”, the candidate sees “Not selected”.
Candidates can also withdraw an application themselves from their dashboard, and a job that’s closed or removed moves its applications to a closed state so nobody waits on a role that no longer exists.
Members see all of this on the Applications tab of the candidate dashboard, which is part of the free plugin. Pro adds a My Applications block you can drop on any page. The screens themselves are covered in using the employer and candidate dashboards, and if you want a stage-by-stage Kanban on top of these statuses, the thinking behind that is in what an applicant tracking pipeline is. The Kanban view itself is a Pro feature.
Exporting applicants to CSV
Sooner or later someone wants the applicants in a spreadsheet: for a hiring manager who lives in Excel, for a record, for a handover.
Employers can export a job’s applicants as a CSV from the Employer Dashboard, and admins can export from the Applications screen in wp-admin. The file has the applicant’s name and email, the job, the status, the date, the cover letter, the resume link and any screening answers.
One detail worth knowing: the resume column holds a link that goes through the same permission check as before. Forward the spreadsheet to someone without access and the link won’t open for them. That’s what you want.
Keeping spam out
Open applications attract bots. Two layers handle it, and both are in the free plugin.
A honeypot field is always on, and it catches the lazy bots at no cost to real applicants. On top of that you can add a CAPTCHA under the Anti-Spam settings tab: reCAPTCHA v3, reCAPTCHA v2 or Cloudflare Turnstile. You paste your site key and secret key, and the check runs on job submission, applications and registration.
Turnstile is the one to try first if you don’t want to put Google in front of applicants. Whichever you pick, test one application as a guest afterwards.
A short checklist
Before you publish the apply form, run through this.
- Ask only for what you’ll use. Name, email and resume cover most roles.
- Set a resume size limit that fits your audience and confirm the Site Health check passes.
- Decide guest or account applications, and set it on purpose.
- Check the status email templates read the way you’d want to be written to.
- Turn on a CAPTCHA if the board is public.
- Export a test application to CSV and open it.
Everything above is Free except custom application questions, the My Applications block and the Kanban pipeline. If you’re weighing the tiers, the features and pricing pages spell out what’s in each.