Documentation: Filedrop
Configuration
Everything lives under Components > Filedrop > Options, across five tabs.
Basic
| Default max. upload size | The maximum size per transfer, 1024 MB out of the box. Enforced incrementally while the upload runs, so an oversized transfer is rejected during the upload, not at the end. |
| Chunk size | The size the browser uploads at a time, 5 MB by default. Because files travel in chunks, your server's single-request upload limits only need to fit one chunk, not the whole file. Lower it on hosts with tight execution-time limits. |
| Maximum expiry | The longest expiry period a sender is allowed to pick for a transfer. |
| BCC e-mail | Optional address that receives a blind copy of every e-mail Filedrop sends. |
Storage
Choose a storage driver: local filesystem, FTP, FTPS, or SFTP. Local storage can point anywhere on the server, including outside the web root, and Filedrop generates a deny-all .htaccess for you on Apache. Remote drivers take a host, port, username, password, and remote folder, with an SFTP-only option to authenticate with a private key instead of a password. The storage folder field shows the path currently in effect underneath it, so you can see exactly what the default resolves to on your server.
An optional storage quota (in MB, 0 = unlimited) and a warning threshold e-mail let you keep an eye on total usage.
Both the local storage folder and the remote folder accept placeholders to build your own structure instead of Filedrop's default layout: {username} (the uploader's Joomla username, empty for guests), {sender_name} (the "Your name" field, lowercased and hyphenated), and {year}/{month}/{day} (the transfer's own upload date). For example: uploads/{year}/{month}/{sender_name}. A configured path is used exactly as-is: the automatic year/month subfolders belong to Filedrop's default layout only, so files land directly in your configured folder unless you add {year}/{month} to the template yourself.
The Connection check, step by step
The Connection check button at the bottom of the tab tests your storage settings before any visitor depends on them. How the test behaves:
- It uses the values as currently filled in on this tab, including changes you haven't saved yet - so you can test first and save once everything is green. Only an empty password field falls back to the last saved password.
- The checks run in order and stop at the first red result: fix that line, then run the test again.
- Nothing is changed on either server beyond one small, uniquely named test file, which is removed again at the end. Existing transfers are never touched.
- Placeholders in the folder fields (
{username},{year}, ...) are resolved with your own username and today's date for the test.
What each line checks, and what a red result means:
| Check | Applies to | What it verifies / if it's red |
|---|---|---|
| PHP extension | FTP, FTPS, SFTP | The required PHP extension on your web server: ftp for FTP, ftp with SSL support for FTPS, ssh2 for SFTP. Red: the extension isn't enabled on your own hosting (this is not about the storage server). Ask your hosting provider to enable it - ssh2 in particular is a PECL extension that isn't installed everywhere. |
| Host | FTP, FTPS, SFTP | The hostname resolves via DNS; the result shows the IP address it resolves to. An IP address entered directly is used as-is. Red: typo in the hostname, or your web server's DNS can't resolve it. |
| Port | FTP, FTPS, SFTP | A TCP connection to the host on the configured port, with a 5-second timeout. An empty port defaults to 21 (FTP/FTPS) or 22 (SFTP). Red: wrong port number, a firewall blocking outgoing connections from your web server, or the storage server being down. FTP and FTPS normally use port 21, SFTP port 22. |
| Private key | SFTP, only when a key path is set | Both the private key file and its .pub counterpart exist at that path on your web server - PHP's ssh2 extension needs both files. Red: wrong path, or the .pub file is missing next to the key. The path must be an absolute path on the web server, not on the storage server. |
| Login | FTP, FTPS, SFTP | An actual connection and authentication with the configured credentials. For SFTP the green result also shows the account's login directory - the folder a relative "Remote folder" is anchored to. Red: wrong username or password (or key passphrase), or the server refuses this authentication method. Check the credentials against a regular FTP/SFTP client. |
| Storage folder | Local | The resolved folder exists (or can be created) and is writable by the web server. Red: the path is outside what the web server may write to, or a permissions problem. The message includes the underlying PHP error. |
| Write test | all drivers | The definitive check: a small test file is written through exactly the same code uploads use (for SFTP including the automatic SCP fallback), verified to exist, and deleted again. Red: whatever the earlier checks couldn't catch - no write permission in the target folder, quota on the storage account, or a server that accepts logins but refuses transfers. The message contains the underlying error. |
Green all the way down means a visitor's upload will store successfully with these settings.
Security
| Rate limiting | Limit how many transfers a single IP address can create in a given time window. |
| Guest access password | Optionally require a site-wide password before anonymous visitors even see the upload form. Logged-in users always skip it. |
| Allowed file extensions | A whitelist, empty by default. Fill it in to accept only those extensions, e.g. jpg,png,pdf - the blocklist below is ignored while this is set. |
| Blocked file extensions | Ships with a sensible default covering executables and server-side scripts. Only enforced when the whitelist above is empty. |
Upload Form Fields
Every field on the upload form - sender name, sender e-mail, recipients, message, expiry, download limit, password - can be set to Optional, Required, or Hidden (expiry only has Shown/Hidden, since it always has a value). Sender e-mail is the one field that defaults to Required rather than Optional, since it's normally needed to reply to the sender or let them know their file was downloaded; every other field defaults to Optional.
Hidden fields aren't just skipped - they use an admin-configured default value instead, enforced on the server so it can't be bypassed. Sender name, sender e-mail, and message all support {name}, {username} and{email} placeholders in their default, resolved to the currently logged-in visitor's own details (empty for guests) - useful for pre-filling or fully hiding these fields on sites where visitors are always logged in.
You can also add an info line under the upload dropzone itself, using {max_filesize} and {allowed_extensions} placeholders, e.g. "Max. {max_filesize} per transfer. Allowed: {allowed_extensions}." to tell visitors what's accepted before they try.
If a sender leaves their e-mail blank (only possible when that field isn't Required) or no recipients end up filled in, Filedrop still creates the transfer and shows the download link on-screen - it just skips whichever notification e-mail would have needed an address it doesn't have.
Advanced
A free-form Custom CSS field, injected into the upload, download, and "My Transfers" pages, for fitting Filedrop's look to your site's own template beyond what its Bootstrap/UIkit-based styling already adapts to.