Skip to main content
Documentation

Setting Up Public Hosting

Public Hosting serves the contents of a folder over a public web URL. Use it to publish documents, forms, embedded assets, or other content that you want available without a Files.com login. Configure the URL, optional password protection, index listings, force-download behavior, and CORS headers per folder.

Enabling Public Hosting (Web Hosting) on Your Site

Public Hosting is configured per folder, through that folder's settings. You must be a site administrator or have admin rights on the folder.

When you activate Public Hosting (Web Hosting) mode for a folder, you specify the URL in the Serve files and sub-folders publicly at the following URL setting. The value can be anything that does not contain reserved, unsafe, or excluded characters as defined by RFC 1738External LinkThis link leads to an external website and will open in a new tab. Space characters are allowed and are handled by most web browsers, but they are encoded in the URL. The value must also be unique among your publicly served folders; you cannot save a value that duplicates another Public Hosting folder setting.

Public Hosting works well for making files broadly available, but it is not a CDN. For large amounts of static content such as images and video, deploy a CDN in front of Files.com Public Hosting to optimize delivery for those scenarios.

URL Keys

The right URL value for your folder depends on what the public site is for. If the contents are intended to be freely available or to serve assets embedded in one of your websites, choose a friendly, descriptive URL that reflects the contents, such as forms.

If the contents are intended to be publicly reachable but hard to find without direct communication from your team, take a security-by-obscurity approach with a URL that resembles a token, such as sh4g7f3gf9xz39h-3hgtr4d or any link no one could reasonably guess without being given it directly.

How to Calculate File URLs

Customers sometimes need to list every URL for the files in a Public Hosting folder, such as when designing a data feed for an automated system.

Each hosting URL looks like this:

https://subdomain.hosted-by-files.com/key/relative/path/to/filename.ext

The URL breaks down into the following parts:

  1. The protocol prefix, always https://.
  2. Your custom subdomain.
  3. The public hosting domain, always hosted-by-files.com.
  4. The key assigned to the hosted folder.
  5. Any subfolders within your hosted folder. If your file is directly in the hosted folder, skip this.
  6. Your file's name and extension.

Combine those parts without spaces. Any character in a folder or file name that is not a letter or number needs to be URL-encoded. For example, a space character in a file or folder name is encoded as %20. This is known as percent-encodingExternal LinkThis link leads to an external website and will open in a new tab.

Including Passwords in Calculated URLs

If you have enabled Password Protection for your hosted folder, you can create URLs that include the username and password. This is useful when non-interactive systems such as curl need to access a password-protected item. The format is:

https://username:password@subdomain.hosted-by-files.com/key/path/to/filename.ext

The URL breaks down into the following parts:

  1. The protocol prefix, always https://.
  2. The username for your password protection, followed by a colon (:).
  3. The password you defined, followed by the at-sign (@).
  4. Your custom subdomain.
  5. The public hosting domain, always hosted-by-files.com.
  6. The key assigned to the hosted folder.
  7. Any subfolders within your hosted folder. If your file is directly in the hosted folder, skip this.
  8. Your file's name and extension.

If your password contains characters other than letters and numbers, the password must be percent-encoded. Do not encode the colon (:) or the at-sign (@) that separate the credentials from the rest of the URL.

Index Pages

Enable Index Pages on a Public Hosted folder to show public listings of the folder contents, including subfolders. This is useful when visitors don't always know the full path to the files they need, or when the folder does not contain an HTML document with a table of links.

When index pages are not enabled, only direct links to files within the folder or its subfolders work. Any attempt to access a folder directly through the public hosting link fails. If you add an HTML file with your own custom index listing, it is served only when visitors request that file directly, not when they request the folder.

Password Protection

You can secure a Public Hosted folder with a single username and password, collected through HTTP Basic authentication. The visitor sees a popup dialog in the browser. You can also include the username and password directly in the URL for use with curl and other non-interactive tools.

Password protection uses a single username and password for the entire folder, shared by everyone who accesses the public URL. To give different people their own credentials, create them as full users on your site instead.

Your site's Password restrictions rules apply to public hosting passwords by default. Site administrators can disable this with the Apply password rules to shares, inboxes, and publicly served folders setting.

Default Download Behavior

By default, Public Hosting does not set a Content-Disposition header on hosted files. When someone opens a publicly shared link, the browser decides how to handle the file based on its default behavior and the file's MIME typeExternal LinkThis link leads to an external website and will open in a new tab.

Files that usually open directly in the browser include images (.jpg, .png, .gif), text files (.txt, .xml, .json), and PDFs (.pdf). Audio and video files (.aac, .mp3, .mp4, .wav, and similar) usually open in the browser, though whether they start playing automatically depends on the browser.

Files that require an external application, such as .zip, .xlsx, .docx, and .exe, are usually downloaded because most browsers do not render them directly. JavaScript files (.js) are treated as text — displayed, not executed.

Because Files.com does not override the browser's default behavior with a Content-Disposition: attachment header, files open or download based on how your browser handles each file type.

To download a file that would normally open in the browser, use the "Save as" command after it opens. Right-clicking a link in most browsers gives you a context menu with a download option.

Force Download Option

To make files always download rather than open in the browser, enable the Force download of files setting on the Public Hosting folder. Files.com then applies a Content-Disposition: attachment header to every file, instructing the browser to download instead of opening.

CORS Header to Enable Cross-Domain Sharing

The default security settings of a Public Hosting folder do not allow Files.com hosted file content to be used, embedded, or dynamically displayed on external websites.

You can configure each Public Hosting folder to Include Cross-Origin Resource Sharing (CORS) Headers. With CORS headers enabled, browsers can access the folder's files from other domains. Enable this when you want your hosted files to be embedded or used directly on external websites.

For example, imagine you have a fundraising campaign, and you want your corporate site to reflect its current status. Your fundraising partners upload a text file each day containing anonymized donation data to a Public Hosting folder on your Files.com site. Your corporate site uses JavaScript to fetch the data from the Public Hosting URL, parse the contents, and display the current total dynamically. The number on the corporate page updates without manual editing.

Disabling Public Hosting (Web Hosting) on a Folder

A site administrator or a user with admin rights to the folder can disable Public Hosting at any time. As soon as the setting is updated, the files are no longer accessible at the previous URL.