# \#secure-uploads **URL:** https://meta.discourse.org/tag/secure-uploads/604.md [Latest](https://meta.discourse.org/latest.md) · [Categories](https://meta.discourse.org/categories.md) · [Tags](https://meta.discourse.org/tags.md) --- ## [Feature request: secure-uploads for S3 backends without per-object ACLs](https://meta.discourse.org/t/feature-request-secure-uploads-for-s3-backends-without-per-object-acls/410069)
**Author:** [@polybos](https://meta.discourse.org/u/polybos)\ **Replies:** 1\ **Last updated:** [September 16, 2026, 1:49pm UTC](https://meta.discourse.org/t/feature-request-secure-uploads-for-s3-backends-without-per-object-acls/410069 "2026-09-16T13:49:00Z")
Problem On S3-compatible backends that don’t support per-object ACLs secure\_uploads cannot coexist with publicly-served content. Avatars and theme/site assets seems to be served via direct, unauthenticated S3 URLs, whic… --- ## [Secure Upload File URLs Changing to uploads/short-url in Public Categories](https://meta.discourse.org/t/secure-upload-file-urls-changing-to-uploads-short-url-in-public-categories/410540)
**Author:** [@Shahrear\_Chowdhury](https://meta.discourse.org/u/Shahrear_Chowdhury)\ **Replies:** 2\ **Last updated:** [August 20, 2026, 4:34pm UTC](https://meta.discourse.org/t/secure-upload-file-urls-changing-to-uploads-short-url-in-public-categories/410540 "2026-08-20T16:34:08Z")
Secure Upload is enabled, and the S3 file links changes when editing a Topic with files: from secure-uploads/original/... → to uploads/short-url/... This only happens in Public Categories. Is this expected behavior, a… --- ## [Add support for secure uploads in chat](https://meta.discourse.org/t/add-support-for-secure-uploads-in-chat/238782)
**Author:** [@Alon1](https://meta.discourse.org/u/Alon1)\ **Replies:** 11\ **Last updated:** [July 1, 2026, 6:17pm UTC](https://meta.discourse.org/t/add-support-for-secure-uploads-in-chat/238782 "2026-07-01T18:17:09Z")
Continuing the discussion from 2.9.0.beta9: Security fix, bug fixes and more: Why is this disallowed? In earlier versions it seemed to work fine with secure media. --- ## [Are the images published in the Staff category publicly visible?](https://meta.discourse.org/t/are-the-images-published-in-the-staff-category-publicly-visible/389903)
**Author:** [@patrickemin](https://meta.discourse.org/u/patrickemin)\ **Replies:** 2\ **Last updated:** [November 28, 2025, 5:52pm UTC](https://meta.discourse.org/t/are-the-images-published-in-the-staff-category-publicly-visible/389903 "2025-11-28T17:52:09Z")
Today I published a post on my Discourse site in the staff category as an administrator. There was an image in this post. The URL for this image is publicly accessible. Is this normal? Thank you. --- ## [Allow Moderators to Access Secure Uploads in Deleted Topics](https://meta.discourse.org/t/allow-moderators-to-access-secure-uploads-in-deleted-topics/389840)
**Author:** [@Teafh](https://meta.discourse.org/u/Teafh)\ **Replies:** 0\ **Last updated:** [November 27, 2025, 6:08pm UTC](https://meta.discourse.org/t/allow-moderators-to-access-secure-uploads-in-deleted-topics/389840 "2025-11-27T18:08:31Z")
When the secure uploads feature is enabled, moderators lose the ability to view or manage attachments (such as images or files) in topics that have been deleted. Only admins retain access to these uploads. While moderato… --- ## [Secure Uploads](https://meta.discourse.org/t/secure-uploads/140017)
**Author:** [@martin](https://meta.discourse.org/u/martin)\ **Replies:** 43\ **Last updated:** [July 24, 2025, 10:30am UTC](https://meta.discourse.org/t/secure-uploads/140017 "2025-07-24T10:30:07Z")
Added in the Discourse 2.4 release in February is the Secure Uploads feature, which provides a higher degree of security for ALL uploads (images, video, audio, text, pdfs, zips, and others) within a Discourse instance. P… --- ## [Personal Message attachments accessible to unauthenticated users (missing auth check)](https://meta.discourse.org/t/personal-message-attachments-accessible-to-unauthenticated-users-missing-auth-check/373355)
**Author:** [@Evie\_Tao](https://meta.discourse.org/u/Evie_Tao)\ **Replies:** 1\ **Last updated:** [July 8, 2025, 11:33am UTC](https://meta.discourse.org/t/personal-message-attachments-accessible-to-unauthenticated-users-missing-auth-check/373355 "2025-07-08T11:33:38Z")
Issue Description During a security assessment of our customized Discourse forum, we discovered a potential authentication issue affecting image attachments uploaded within private messages. Details Upload API: /uploa… --- ## [Can I use secure media and page publishing simultaneously in Discourse?](https://meta.discourse.org/t/can-i-use-secure-media-and-page-publishing-simultaneously-in-discourse/272753)
**Author:** [@JQ331](https://meta.discourse.org/u/JQ331)\ **Replies:** 2\ **Last updated:** [February 21, 2022, 3:21pm UTC](https://meta.discourse.org/t/can-i-use-secure-media-and-page-publishing-simultaneously-in-discourse/272753 "2022-02-21T15:21:55Z")
After enabling secure media, I saw this: “Page publishing cannot be enabled if secure media is enabled.” (when I tried to turn on page publishing in admin settings) I currently need to use page publishing, so was surpr… --- ## [Do all uploads in Discourse go to the 'original' folder when using a CDN?](https://meta.discourse.org/t/do-all-uploads-in-discourse-go-to-the-original-folder-when-using-a-cdn/272751)
**Author:** [@phil22](https://meta.discourse.org/u/phil22)\ **Replies:** 1\ **Last updated:** [July 21, 2023, 9:27am UTC](https://meta.discourse.org/t/do-all-uploads-in-discourse-go-to-the-original-folder-when-using-a-cdn/272751 "2023-07-21T09:27:21Z")
I have a question re using a CDN with secure uploads. In https://meta.discourse.org/t/secure-uploads/meta/140017/118?u=phil22 it sounds like the CDN isn’t used for uploads but can be used for assets. At the moment my CD… --- ## [How the media in the posts look like when secure uploads are enabled?](https://meta.discourse.org/t/how-the-media-in-the-posts-look-like-when-secure-uploads-are-enabled/272752)
**Author:** [@kinetiksoft](https://meta.discourse.org/u/kinetiksoft)\ **Replies:** 5\ **Last updated:** [February 28, 2023, 2:01pm UTC](https://meta.discourse.org/t/how-the-media-in-the-posts-look-like-when-secure-uploads-are-enabled/272752 "2023-02-28T14:01:06Z")
Our forum instance generates thousands of media files daily and the numbers are growing. We are thinking about introducing certain limitations to encourage users to sign up and to reduce the server load too. We’re wonder…