--- title: File Upload Settings slug: file-upload-settings createdAt: 2025-06-11T20:26:19.223Z --- Activate uses a secure and configurable mechanism to control how files and images are uploaded. These settings are managed under `//Resources/Configuration/Uploads` # Maximum File Size The **MaxFileSize** parameter defines the maximum number of bytes a file can be before the upload is rejected. Each **FileUpload** or **ImageUpload** control can also have its own MaxFileSize setting. These control-level limits must be **equal to or smaller** than the global value defined in //Resources/Configuration/Uploads. # Valid File Types Each upload control defines a list of valid file extensions that it accepts. These are checked during upload initiation. At the server level, an additional set of **ValidFileTypes** parameters is defined under //Resources/Configuration/Uploads: - The system parameter should **not be modified**. - Custom file types can be added by creating additional ValidFileTypes\* parameters. # File Signature Validation Activate does not rely solely on file extensions for validation. Each uploaded file is checked to ensure that its content matches the declared file type. For example, a GIF file definition verifies that the file begins with the proper content signature: :::BlockQuote \ \47 49 46 38\ \ ::: This ensures that the uploaded file’s internal structure matches its extension, providing protection against spoofed or malicious files.