Loading

Configure the setting 'File Upload and Download Security'

Publish Date: Jun 10, 2026
Description

Salesforce allows administrators to configure how specific file types are handled when uploaded or downloaded by users. The File Upload and Download Security settings page lets admins control whether files open in the browser or are forced to download, helping prevent security vulnerabilities from potentially malicious file types such as .html, .svg, or .exe files.

 

Resolution

Configuring File Upload and Download Security Settings

To manage file upload and download settings, Navigate to Setup > Security > File Upload and Download Security. From this page, you can change each MIME type's behaviour between Execute in Browser, Sandbox, Hybrid Sandbox, or Download. For step by step instructions on how to manage file upload and download settings, visit Configure File Upload and Download Security Settings 

 
Note: The File Upload and Download Security page replaces another security settings page: HTML Documents
and Attachments Settings.
 

Supported File Types and Associated Extensions

 

File types are defined by MIME types. This table specifies the file extensions associated with each MIME type:
 
File Type(MIME Type)
Associated File Extensions
.avi
.avi
.doc
.doc, .dot
.docx
.docx
.exe
.exe, .wrf
.html
.html
.htt
.htt
.mov
.mov
.mp3
.mp3
.mp4
.mp4
.mpeg
.mpeg, .mpg
.pdf
.pdf
.ppt
.ppt, .pps, .pot
.pptx
.pptx
.svg
.svg
.thtml
.acgi, .htm, .htx, .shtm, .shtml, .thtml
.txml
.txml
.wav
.wav
.wma
.wma
.wmv
.wmv
.xls
.xls, .xlt
.xlsx
.xlsx
.xml
.xml
 


File Types That Download by Default

 

The following file types are set to download by default and cannot be changed to execute in browser.

File Type (MIME Type)
Associated File Extensions
.exe
.exe, .wrf
.html
.html
.htt
.htt
.mht
.mht, .mhtm, .mhtml
.svg
.svg
.thtml
.acgi, .htm, .htx, .shtm, .shtml, .thtml
.txml
.txml
.xml
.xml
 

Administrators can Configure File Upload and Download Security Settings to change the default behaviour.

Knowledge Article Number

000386250

 
Loading
Salesforce Help | Article