Block file uploads by filename extension

You can block file uploads based on filename extension to prevent users from uploading specific file types to websites. Extension blocking works alongside true file type blocking to provide layered upload controls.

When a user uploads a file, the system checks the filename extension (for example, .exe, .bat, .pdf) against your configured rules. If the extension matches a blocked extension, the upload is denied and the user sees a block notification page.

To configure upload file extension blocking, go to Web > Policy Management > File Blocking > Upload

You can:

Block specific extensions: Add one or more file extensions to block (for example, exe, bat, cmd, ps1, doc, pdf). Extensions containing hyphens or underscores (for example, deb-src) are supported.

Set a file size threshold: Optionally block uploads only when the file exceeds a specified size (for example, block .pdf uploads larger than 100 KB).

Scope by user or group: Apply blocking rules to specific users or groups, or exempt specific users or groups from a rule.

Scope by web category: Block uploads to specific destination web categories (for example, block .pdf uploads to personal webmail) or allow uploads only to selected categories.

Allow-list (override)

You can create an allow-list of extensions that overrides the block rules. For example, you can block all document uploads (.pdf, .docx, .doc, .xls, .xlsx) but explicitly allow .pdf and .docx. The allow-list is evaluated before the block rules.

Note: If an extension is allowed by the allow-list, the true file type check is also skipped for that file. This means an explicit extension allow takes precedence over a file type block.

How extension blocking works with other upload controls

Upload blocking is evaluated in the following order:
  1. File size: If a file exceeds the configured size limit, it is blocked regardless of extension or file type.
  2. File extension: If the file passes the size check, the filename extension is evaluated against your extension rules.
  3. True file type: If the file passes the extension check (or no extension rule applies), the file content is inspected to determine its true file type.

This means a file size rule always takes priority, followed by extension rules, and then true file type rules.

Block notification page

When a file is blocked by an extension rule, the block page displays the matched extension. For example:

File has been blocked because of file extension: 'exe'

Limitations

  • Extension blocking checks the filename only, not the file content. A user could rename a file to bypass an extension rule (for example, renaming malware.exe to document.txt). For stronger protection, use extension blocking together with true file type blocking.
  • Filename must be available. If the upload request does not include a filename (for example, a raw body POST without a Content-Disposition header), extension blocking cannot evaluate the file and the upload is allowed by this filter.
  • Large multipart uploads (over 250 MB). For multipart uploads exceeding 250 MB, individual filenames within the multipart body are not extracted. However, filenames from request-level headers are still checked.
Best practice

  • Use extension blocking and true file type blocking together for defense-in-depth:

  • Extension blocking provides quick, name-based administrative control and compliance enforcement.

  • True file type blocking detects the actual file content regardless of the filename, catching renamed or disguised files.