I wonder if we have a form allowing file uploads for front end users, does Craft or its plugins have certain feature to scan for virus / malicious content, before saving it? If not, what would be the best practice to handle front-end users' uploads? E.g. shall it be handled by the hosting server, or is there a 3rd party library / service that can help?

1 Answer 1


Craft will do some minimal cleansing of potentially malicious uploaded images by default by saving them back out to the file system and will try to sanitize SVG files as well.

It also has a relatively tame list of file extensions it allows on upload: https://docs.craftcms.com/v3/config/config-settings.html#allowedfileextensions

Anything outside of that, it'd be up to a Craft plugin or something on the server-side to do additional analysis and cleansing.

  • Thanks Brad, good to know.
    – Wei
    Sep 23, 2019 at 23:55

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.