Running a Careers Page Without a Job-Board Subscription

A lot of job-board subscriptions are priced for companies hiring continuously across many roles. A small business that posts two or three openings a year is paying for infrastructure it barely touches — what it actually needs is a careers page, an application form, and somewhere to move candidates from "applied" to "hired."

The part that's easy to get wrong: résumé uploads

Accepting file uploads from the public internet is one of the riskier things a small site can do if it's not handled carefully. A file that claims to be a PDF isn't necessarily one, and a filename can be crafted to try to trick a server into running it rather than storing it. Handling this safely means checking more than just the file extension.

Why a careers page needs a real pipeline, not just an inbox

Applications arriving as email attachments turn hiring into an inbox- management problem — nothing tracks who's been reviewed, who's shortlisted, or who was already rejected weeks ago when they apply again for a different role. A real pipeline with actual stages solves a different, more useful problem: knowing where every candidate actually stands.

How the Job Portal handles both

Our Job Portal with Résumé Uploads publishes a public careers page with search, and a job page with an application form accepting PDF, DOC or DOCX résumés up to 2MB. Every upload is checked by size, extension, and the file's actual contents — not just what the filename claims — and stored under a random name that only the admin can retrieve, so uploaded files are never directly guessable or browsable from outside.

One application per email address per job is enforced, and applications submitted after a job's closing date are refused automatically. Candidates move through a real pipeline — new, shortlisted, interviewed, hired or rejected — forward only, so the status always reflects where they genuinely are. Deleting an application deletes its résumé file too, so there's no accumulation of orphaned files sitting on the server long after the application they belonged to is gone.

This is built for one employer or agency, not a multi-employer marketplace — no employer or candidate accounts, no saved jobs or candidate profiles. It doesn't parse résumés, send emails or calendar invites, schedule interviews, or scan uploads for malware (validation checks type and size, not virus content). It needs hosting that allows file uploads of at least 2MB, and for extra safety, `UPLOAD_DIR` in config.php can be pointed outside the public web root.

FAQ

Is a resume checked for more than just its file extension?

Yes — uploads are validated by size, extension and the file's actual binary contents, which stops a disguised file from passing as a PDF just because of its name.

Can someone apply twice for the same job with the same email?

No — one application per email address per job is enforced, and applications after the posting's closing date are refused.

Does this scan uploaded résumés for viruses?

No — validation checks file type and size, not malware content. That would be a separate, realistic addition on top of what's included.