# Explicitly disallowed file types?

**URL:** https://meta.discourse.org/t/explicitly-disallowed-file-types/11907
**Category:** Support
**Created:** [2014年一月12日 20:38 UTC](https://meta.discourse.org/t/explicitly-disallowed-file-types/11907 "2014-01-12T20:38:49Z")
**Posts on this page:** 2
**Page:** 1

<div class="post-metadata">

### Author: ![supermathie](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/supermathie/32/507518_2.png) [@supermathie](https://meta.discourse.org/u/supermathie)
#### Post date: [2014年一月12日 20:38 UTC](https://meta.discourse.org/t/explicitly-disallowed-file-types/11907/1 "2014-01-12T20:38:49Z")

</div>

In the Site Settings, the Discourse administrator can configure a list of allowed file types for uploaded files.

Which file types should be explicitly disallowed - such that we prevent (or at least pop up VERY SEVERE WARNINGS) administrators from even allowing them?

- .htm, .html: to prevent XSS attacks

---

<div class="post-metadata">

### Author: ![michaeld](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/michaeld/32/1594_2.png) [@michaeld](https://meta.discourse.org/u/michaeld)
#### Post date: [2014年一月12日 21:17 UTC](https://meta.discourse.org/t/explicitly-disallowed-file-types/11907/2 "2014-01-12T21:17:46Z")

</div>

To prevent XSS: .js, .swf, .html, .htm

To prevent attacks on the server: .shtml, .php, .php3, .cgi, .pl, .py