Why you can't attach images to Shopify contact forms and how to fix it
Photos for returns/exchanges, images for repair requests, reference materials for custom orders.
If you operate an e-commerce site, there will inevitably be situations where customers want to "send an image." However, when trying to accommodate this with Shopify's standard forms, many merchants hit a wall.
Shopify's contact forms do not have a file attachment feature.
This article explains the structural reasons why image attachments are not possible with Shopify, and discusses solutions and their caveats.
Reasons Why Shopify's Standard Forms Don't Allow Image Attachments
In short, this is not a "defect" in Shopify but a security design.
Shopify is a SaaS (Software as a Service) e-commerce platform. Your store, along with hundreds of thousands of others, runs on the same Shopify servers.
In such a shared environment, allowing external users (i.e., your customers) to upload files to the server poses a security risk. Even one malicious file upload could potentially affect the entire platform.
For this reason, Shopify does not permit external file uploads. This is less of a restriction and more of a design choice to protect the platform.
Solution: Implementing a Third-Party App
If you search for "Shopify image attachment not possible," you'll quickly find an answer:
Install a third-party email form app.
There are many form apps in the Shopify App Store, and many of them support image attachments. They are easy to implement, and many merchants choose this method.
However, there's one thing I want you to check here.
An Overlooked Problem: Where Is the Data Stored?
When you implement a form app, where are the customer inquiries and attached files stored?
Some might think they are stored in "Shopify." Or perhaps some believe they are "only delivered via email and not stored anywhere."
The reality is different. The answer is "on the app provider's server."
Even if an app is installed from the Shopify App Store, the app is developed and operated by a third-party company, not Shopify. Data submitted through the form is stored on servers managed by that company.
If it's an overseas app, the data will be stored on overseas servers. All inquiry content and attached personal information will be under the management of an overseas company with whom you have no NDA.
Information Security Policy Issues
At this point, please consider this calmly.
- Have you signed an NDA with the app provider?
- Do you know where your customer data is stored?
- Have you verified how it is stored and managed?
Most likely, the answer for almost everyone is "No."
No NDA, no confirmation of server location or storage method. Entrusting customers' personal information to a third party in such a state—from an information management perspective, this is tantamount to tacitly condoning a data breach.
Have you ever received a complaint from a customer like, "I've been getting more spam emails since I submitted an inquiry"?
If so, you permitted it. By entrusting data to a third party without confirmation, you tacitly condoned it.
Do you often see news about data breaches? Japanese companies are often said to have a lax attitude towards security. You might think, "We'll be fine," but when held accountable, "I just entrusted it to an app" is not an excuse. The responsibility for managing customer data lies with the store operator.
Especially for listed companies, companies preparing for IPO, B2B businesses, and industries that handle a lot of personal information (such as healthcare, finance, education), this is not something that can be dismissed with "it's convenient."
So, What Should Be Done?
After reading this far, you might be thinking, "What should I do then?"
There are two options:
- Create your own form and host it on your company's server.
- Use a form app that can directly save to your company's server.
First, let's consider the first option: creating your own form.
The Reality of Self-Made Forms
"If entrusting data to external apps is a problem, then I'll just create my own form."
Some might think that. Creating a form with PHP and hosting it on your company's rental server is technically possible.
However, forms without security measures become entry points for spam and viruses.
Email forms are prime targets for attackers.
- CSRF attacks: Unauthorized submissions through impersonation
- XSS attacks: Embedding malicious scripts
- Malicious file uploads: Entry points into the server
Creating a "working form" is relatively easy, but creating a "secure form" is a completely different level of difficulty. Implementing CSRF tokens, sanitizing input values, validating files, rate limiting—all of these require specialized knowledge to implement effective countermeasures.
Option 2: Form Apps That Can Directly Save to Your Company's Server
The other option is to use a form app that can directly save to your company's server.
Our "Mailform.JP" was created to solve this problem.
Features of Mailform.JP
Customer data is saved directly to your company's server.
Inquiry content and attached files are saved directly to the FTPS server you specify (XServer, Sakura, Lolipop, ConoHa, etc.). No data remains on the app's side.
Professional-level security measures as standard.
CSRF countermeasures, XSS countermeasures, reCAPTCHA, Honeypot, rate limiting—security features that usually require specialized knowledge to implement are built-in and require no configuration.
Freedom in coding.
You can freely write HTML, CSS, and JavaScript, allowing you to create forms that are fully integrated with your store's design.
To Be Honest
Mailform.JP is not a "form generator" that allows you to easily create forms with drag-and-drop.
We do not prioritize appearance or ease of implementation. Our goal is to reduce the risk of business failure—data breaches and security incidents.
Therefore, it may not suit the needs of those who "just need it to look good for now" or "don't really understand, but just want a form that allows image attachments."
However, for those who are serious about customer data management responsibility and companies that need to comply with information security policies, it should be the optimal choice.
Please see the following page for detailed features and pricing plans.
Summary
The inability to attach images to Shopify's standard forms is due to the security design of the SaaS platform.
When implementing a third-party app as a solution, it is recommended to confirm where customer data will be stored. Especially for listed companies, B2B businesses, and industries that handle a lot of personal information, it is necessary to consider consistency with information security policies.
If you want to keep customer data under your own management, consider using a form app that can directly save to your own server.