Receiving applications
What the Vakanssi application form asks for, how uploaded CVs are kept private, the built-in and optional spam protection, and what happens when someone applies.
On this page(4)
Every published job page ends with a ready-made application form. You do not build it, style it, or connect it to anything. Candidates apply right there on the job page: no redirect to another site, no account to create, no login. This page explains what they fill in, how their CVs are protected, how Vakanssi keeps out spam, and what happens the moment someone applies.
What the form asks for
Under the heading Apply for this position, a candidate fills in a short form:
| Field | Required |
|---|---|
| First name | Yes |
| Last name | Yes |
| Yes | |
| Phone | Optional |
| LinkedIn profile (shown unless you turn it off) | Optional |
| Where are you based? (remote jobs only) | Optional |
| CV / Résumé (PDF or Word, up to 5 MB by default) | Yes |
| Cover letter (up to 20,000 characters) | Optional |
| Consent checkbox | Yes |
On a remote job, the country question lists the countries the role is open to beneath it, so recruiters can spot an applicant from outside them. Since v0.37.3, a cover letter longer than 20,000 characters (roughly 3,000 words) is refused with a message naming the field, the same way an over-long name or phone number is.
The last field is a required consent checkbox. Its label reads, “I consent to the storage and processing of my personal data for this application.” If your site has a privacy policy page set in WordPress and that page is published, a link to it appears right after the label. A draft privacy page adds no link.
A candidate cannot submit without ticking the box, which keeps you on the right side of privacy rules.
If you would rather state the retention period on the form itself instead of only in your privacy policy, turn on Show on the apply form under Settings, then General, then Data retention. It is off by default.
A line of small print then appears beneath the Submit button, for instance “We keep your application for up to 24 months, then delete it,” using the retention window described in Privacy & GDPR.
After a successful submission, the candidate sees a confirmation on the same page. If something is wrong, a missing field or a file that is too large, they get a clear notice instead and nothing is saved. Their typed answers are kept in the form; only the CV has to be attached again, because browsers clear file choices.
A job that is closed, unpublished, or password-protected (and the visitor has not entered its password) refuses the application with “This position is no longer accepting applications.” For a closed job, the refusal shows on the job’s own page. Since v0.37.8, an unpublished or password-protected job sends the refusal to your home page instead, since its own page cannot show it.
How CVs are kept private
A CV is sensitive personal data, so Vakanssi handles it carefully. Uploaded CVs are not added to your public media library where anyone with the link could open them. Instead:
- They are stored in a protected folder inside your uploads directory (
uploads/vakanssi). Vakanssi locks that folder against direct web access and tests over the web that the lock works, warning you in Site Health and on the Tools, then Status tab if it does not. - Each file is saved under a random, unguessable filename, so nobody can find one by guessing a link.
- Each upload is type-verified: Vakanssi checks the file’s actual contents, not just its name, so a renamed file pretending to be a PDF is rejected.
- The only way to download a CV is through Vakanssi itself, which first checks that the person is signed in and has permission to view that application. Only permitted team members can get the file.
CVs never sit in a public folder
This protection is what keeps applicant data safe, so leave it in place. On some servers Vakanssi cannot confirm on its own that the CV folder is sealed off, and it will show a warning on your admin screens with the exact one-minute fix. Resolve it promptly. See Troubleshooting for the steps.
Keeping out spam
Job forms attract bots, so Vakanssi ships three layers of protection that run on every form automatically. They are free, need no setup, and your real candidates never notice them:
- A honeypot, an invisible extra field. People never see it; bots fill everything in, so any submission with it filled is rejected.
- A time-trap, which rejects submissions that arrive within a few seconds of the page loading, because only a machine fills a form that fast.
- Rate limiting, which caps how many applications one internet connection can send per hour (five out of the box), so nobody can flood you.
For an extra layer, add a CAPTCHA challenge, the “prove you are human” test some forms show. Go to Hiring, then Settings, then Application form, and choose a provider under Anti-spam challenge. The free option is Cloudflare Turnstile, a quiet challenge most people pass without clicking anything. Advanced anti-spam Pro feature, requires a Vakanssi Pro license adds two more providers, hCaptcha and reCAPTCHA v3; without Pro, the list does not offer them.
The same card has a Provider unreachable checkbox, on by default: “Let applications through if the challenge cannot be checked (fail open)”. Leave it on, so an outage at the provider does not turn away real applicants; the built-in defenses run either way.
A candidate who simply misses the challenge, or whose check could not be completed, is not treated as a bot: their typed answers stay on the form, and the attempt is not held against the rate-limit cap above. What does count toward the hourly cap: a filled honeypot, a form sent too fast or left open more than two days, a token the challenge rejects, and each successful application.
Since v0.33.17, the challenge sits just above the consent checkbox and Submit button, not between the form fields, whichever provider you pick. Cloudflare Turnstile also stays fully invisible unless a visitor actually needs to click through, and any box it does show is light and in the page’s own language, not the visitor’s device settings.
Each provider needs a site key and a secret key from that provider’s own dashboard, pasted into the card of fields that appears once you pick it; leave either blank and Vakanssi warns you right there, since without both keys no challenge is actually shown.
Once you have saved both keys, click Test these keys on the same card: it runs a real challenge and tells you plainly whether the pair works, so you find out now rather than when real applicants start failing it.
The same tab also holds the accepted CV file types, maximum upload size, and the LinkedIn field toggle from the table above.
The baseline always runs
Choosing a CAPTCHA is optional. Whether or not you add one, the built-in honeypot, time-trap, and rate limiting are always on. That is why there is no puzzle on the form by default.
What happens the moment someone applies
Behind the confirmation the candidate sees, four things happen:
- The application is filed against a candidate record. Vakanssi keeps one record per person, matched by email address. If the same person applied to another of your jobs before, this new application is linked to their existing record instead of creating a duplicate. (It even recognises Gmail spelling variations, like added dots.)
- A repeat submission to the same job doesn’t create a second application. If someone submits again while their earlier application to that job is still active, a double-click, a page refresh, an anxious resubmit, or a correction because they attached the wrong file the first time, Vakanssi quietly treats it as the same application instead of adding a second card to your pipeline.
- If the resubmission carries a new CV, it is kept and added to that same application rather than thrown away, so a candidate who notices their mistake and reapplies does not lose the correction. See The candidate panel for how more than one CV on an application shows up.
- A byte-identical resubmission of the same file is recognised and ignored, same as before. Applying again after being rejected or withdrawing still works and starts a fresh application.
- The candidate gets a confirmation email, so they know their application arrived. You control the wording in Emails.
- Your team gets a notification email with the candidate’s name and contact details and a link that opens the application in your admin. It goes to the job’s own notification address if it has one (see Creating a job), otherwise to Notify recruiter at under Settings, then Emails, and failing that to the site’s WordPress admin email.
For developers: extra form fields
Since v0.37.6, the form handler reads a fixed list of named fields rather than everything submitted. A field your code adds through vakanssi/intake/form_fields must also be named with the vakanssi/intake/posted_fields filter. Otherwise it is not passed to spam checks and is not kept when the form is shown again after an error. See Hooks.
The application then lands on your Applications screen (Hiring, then Applications), where you review it and move the candidate through your hiring stages. The badge next to Hiring in the menu shows how many new applications are waiting. See Working with Applications for the full tour, and Privacy for how long applicant data is kept and how erasure requests work.