Limit Uploaded Files To Certain File Extensions

This folder setting controls which file extensions are allowed when files are uploaded into the folder.

It helps enforce filename requirements, for example accepting only names ending in .pdf or .txt. The setting checks the extension in the filename; it does not inspect the file's contents to determine its format. Malware Scanning inspects file contents for malware.

The restriction checks the name a file is uploaded under through any interface, including Inboxes and Share Links. For a copy, move, or rename of an existing file, it checks the destination filename. These checks also apply to files delivered by Syncs and Automations.

Archive Removed Files disregards this restriction on its destination to preserve existing content, including files with extensions that the destination otherwise rejects.

By default, the setting behaves as a whitelist, meaning only the extensions you specify are accepted. You can switch the setting to blacklist mode to block specific extensions instead.

If this setting is not applied to the folder directly and is not inherited from a parent folder, the folder accepts files of any extension.

This rule applies to all subfolders unless explicitly overridden at a deeper level.

Folder moves or copies into restricted folders fail when the destination path has stricter file extension rules than the source path.

Individual files copied or moved into any folder within a Remote Server Mount must meet the applicable filename rule, including one inherited from above the mount. Through _/Sites/, the storing Site's rule applies; through a Partner Channel Route Path, the final target's rule applies. Access Across Sites and Storage explains these boundaries.

Extension Comparison

The setting compares the extension in the submitted filename with the configured list, ignoring only uppercase and lowercase differences. Accents are not removed, and fullwidth characters or other Unicode spellings are not converted to equivalent base or ASCII characters. For example, é and the fullwidth ｅ are each different from e for this comparison. The same comparison applies whether the list allows or blocks extensions.

For example, an extension rule blocking exe rejects report.exe and report.EXE, but does not reject report.éxe or report.ｅxe.

Extension matching is separate from path lookup. On Files.com storage, a file stored as report.éxe can be retrieved using report.exe because path lookup ignores accents. The extension restriction checks the name supplied for an upload, copy, move, or rename; it does not change how stored paths are looked up.

Filename Checks and Folder Processing

The extension check runs before Rename Uploaded Files and GPG Decryption, following the processing order for new files. It is not repeated on the name produced by the renaming rules or by decryption removing its suffix. The folder therefore stores the extension those settings produce, even if that extension would not be accepted on an incoming file.

For example, a folder that allows only .gpg uploads can accept report.csv.gpg and store it as report.csv after successful decryption removes .gpg. A folder that allows only .csv uploads can also use Rename Uploaded Files to save an accepted file with a .txt extension. Renaming an existing stored file to a restricted extension is a separate operation and is still rejected.

Configure the extension limit for the names your senders provide, and configure renaming and decryption for the final names your downstream systems need.

Overriding Settings in Subfolders or Excluding Subfolders Entirely

Administrators with adequate privileges can set the Limit uploaded files to certain file extensions option on a subfolder to define its own extension rules, overriding what the subfolder would otherwise inherit from its parent.

Changing the Setting on the Root Folder

When this setting is on the site's root folder, Root Folder Settings can allow only Site Administrators to change it. Folder admins can still see the setting but cannot change it.

Applying the Setting in Every Workspace

When this setting is on the site's root folder, Root Folder Settings can also make it apply in every Workspace on the site, including Workspaces created later.

Workspace Administrators can still define different extension rules on their Workspace's root folder or subfolders to accept the file formats their workflows require. Those rules take precedence within their scope, even when they allow extensions the site-root rule blocks. Only a Site Administrator can create, change, or remove an exception that disables the inherited site-root extension restriction entirely.

Adding the Setting to Every Child Site

A Child Site Management Policy can add this setting to the root folder of every Child Site it covers. While the setting is part of a policy, nobody on the Child Site can change it.