Types of files that cannot be added to a list or library

For security reasons, some files are blocked in SharePoint on-premise (2016, 2013, 2010). For more info, start with Blocked file types for SharePoint 2016 on-premise. SharePoint Online and OneDrive for Business do not block any files by default. However, there are exceptions. For more info, see SharePoint Online and OneDrive for Business below.

This article was updated February 16, 2017 thanks to customer feedback.

SharePoint Online and OneDrive for Business and web files

SharePoint Online and OneDrive for Business do not block uploading any files by default, but there are exceptions with web files. Web files are script or code files that run on the server or in the browser. When enabled, the files will run from a library when accessed. This allows a designer or developer to add web services or active pages to a SharePoint or OneDrive for Business page.

Note: With group-connected team sites, you cannot upload these files at all.

File extension

File type

.aspx

ASP.NET Active server page

.asmx

ASP.NET web services source file

.ascx

ASP.NET wep user control file

.master

ASP.NET master web page

.xap

Windows phone installation

.swf

ShockWave Flash

.jar

Java archive

.xsf

Office InfoPath form definition file

.htc

HTML Component file

There are two methods of uploading files, using the OneDrive for Business sync client, or through the browser using drag and drop or an upload button.

To upload web files, scripting must be enabled. Scripting is turned off by default in OneDrive for Business and SharePoint Online. When you turn scripting capabilities on, you also enable many other features. For details see Turn scripting capabilities on or off.

Design or contribute permissions are also required to upload web files. For more information on permissions, see Understanding permission levels in SharePoint.

If you use the sync client with OneDrive for Business, you can upload any file. This is because OneDrive for Business is essentially your personal storage. For example, developers can backup code and files for their web projects to their OneDrive site without issues.

For SharePoint Online using either the sync client or the browser upload, or OneDrive for Business using the browser upload you'll need to have scripting turned on and have the appropriate permissions.

Here's a summary:

Upload Method

OneDrive for Business

SharePoint Online

Group-connected team sites

Using the sync client

Always allowed

Need permissions and scripting enabled

blocked

Browser upload, drag and drop

Need permissions and scripting enabled

Need permissions and scripting enabled

blocked

File variations

There are certain types of files that you can't upload to a list or a library on SharePoint on-premise. By default, SharePoint on-premise blocks these file types. For example, if .asp is on the list of blocked file extensions, a file called "newpage.asp" is blocked.

Variations of a file extension are also blocked. The following list shows different ways of representing the same file, all of which are blocked if the .hta extension is on the list of blocked file extensions.

  • filename.hta

  • filename.hta.

  • filename.hta.{3050F4D8-98B5-11CF-BB82-00AA00BDCE0B}

  • filename.hta::$DATA

The list of files that is blocked for SharePoint 2016 on-premise is different than previous on-premise versions of SharePoint.

Note: These lists are the standard files that SharePoint blocks. Administrators can add more types of files to block. If you find file types that aren't listed here, but are blocked, speak to your SharePoint admin or manager.

Blocked file types for SharePoint 2016 on-premise

These are the default blocked file types for new SharePoint 2016 on-premises deployments.

File extension

File type

.ashx

ASP.NET Web handler file. Web handlers are software modules that handle raw HTTP requests received by ASP.NET.

.asmx

ASP.NET Web Services source file

.json

JavaScript Object Notation file

.soap

Simple Object Access Protocol file

.svc

Windows Communication Foundation (WCF) service file

.xamlx

Visual Studio Workflow service file

Filenames that include braces (for example, filename.{doc}) are blocked automatically.

Add or remove blocked files to SharePoint 2016 on-premise

If you have farm administrator permissions, you can add or remove blocked file types.

  1. Open SharePoint Central Administration.

  2. Click Security, and then click Define blocked file types.

    Set blocked files from central administration security
  3. To change the web application, click the link next to Web Application: and then click Change Web Application.

    Change web app option

    In the Select Web Application dialog, click an app.

    Select an web app from the change web app page
  4. On the Blocked File Types page, do one of the following:

    To add a file to block, type a file extension (with the period), one per line.

    To stop blocking a file, select the file extension and press the Del key.

    List of blocked files

    If you delete the wrong file by accident, press CTRL + Z to undo.

    Note: You do not have to type a file name extension in the list in alphabetical order. The next time that you open the list, the file name extension you added will be correctly sorted in alphabetical order.

  5. Click OK.

Blocked file types for SharePoint Foundation and SharePoint Server 2013 and 2010

For on-premises deployments of SharePoint Foundation or SharePoint 2013 and SharePoint Server 2010, a server administrator can add or remove file types from the list of blocked file types. For more information about how to work with blocked file types for SharePoint Server sites, see one of the following articles, depending on the version of SharePoint you have:

The following file types are blocked by default in on-premises deployments of SharePoint.

File extension

File type

.ade

Microsoft Access project extension

.adp

Microsoft Access project

.asa

ASP declarations file

.ashx

ASP.NET Web handler file. Web handlers are software modules that handle raw HTTP requests received by ASP.NET.

.asmx

ASP.NET Web Services source file

.asp

Active Server Pages

.bas

Microsoft Visual Basic class module

.bat

Batch file

.cdx

Compound index

.cer

Certificate file

.chm

Compiled HTML Help file

.class

Java class file

.cmd

Microsoft Windows NT command script

.com

Microsoft MS-DOS program

.config

Configuration file

.cnt

Help Contents file

.cpl

Control Panel extension

.crt

Security certificate

.csh

Script file

.der

DER Certificate file

.dll

Windows dynamic-link library

.exe

Executable file

.fxp

Microsoft Visual FoxPro compiled program

.gadget

Windows Gadget

.grp

SmarterMail group file

.hlp

Help file

.hpj

Hemera Photo Objects Image File

.hta

HTML program

.htr

Script file

.htw

HTML document

.ida

Internet Information Services file

.idc

Internet database connector file

.idq

Internet data query file

.ins

Internet Naming Service

.isp

Internet Communication settings

.its

Internet Document Set file

.jse

JScript Encoded script file

.json

JavaScript Object Notation file

.ksh

Korn Shell script file

.lnk

Shortcut

.mad

Shortcut

.maf

Shortcut

.mag

Shortcut

.mam

Shortcut

.maq

Shortcut

.mar

Shortcut

.mas

Microsoft Access stored procedure

.mat

Shortcut

.mau

Shortcut

.mav

Shortcut

.maw

Shortcut

.mcf

Multimedia Container Format

.mda

Microsoft Access add-in program

.mdb

Microsoft Access program

.mde

Microsoft Access MDE database

.mdt

Microsoft Access data file

.mdw

Microsoft Access workgroup

.mdz

Microsoft Access wizard program

.ms-one-stub

Microsoft OneNote stub

.msc

Microsoft Common Console document

.msh

Microsoft Agent script helper

.msh1

Microsoft Agent script helper

.msh1xml

Microsoft Agent script helper

.msh2

Microsoft Agent script helper

.msh2xml

Microsoft Agent script helper

.mshxml

Microsoft Agent script helper

.msi

Microsoft Windows Installer package

.msp

Windows Installer update package file

.mst

Visual Test source files

.ops

Microsoft Office profile settings file

.pcd

Photo CD image or Microsoft Visual Test compiled script

.pif

Shortcut to MS-DOS program

.pl

Perl script

.prf

System file

.prg

Program source file

.printer

Printer file

.ps1

Windows PowerShell Cmdlet file

.ps1xml

Windows PowerShell Display configuration file

.ps2

Windows PowerShell Cmdlet file

.ps2xml

Windows PowerShell Display configuration file

.psc1

Windows PowerShell Console file

.psc2

Windows PowerShell Console file

.pst

Microsoft Outlook personal folder file

.reg

Registration entries

.rem

ACT! database maintenance file

.scf

Windows Explorer command file

.scr

Screen saver

.sct

Script file

.shb

Windows shortcut

.shs

Shell Scrap object

.shtm

HTML file that contains server-side directives

.shtml

HTML file that contains server-side directives

.soap

Simple Object Access Protocol file

.stm

HTML file that contains server-side directives

.svc

Windows Communication Foundation (WCF) service file

.url

Uniform Resource Locator (Internet shortcut)

.vb

Microsoft Visual Basic Scripting Edition (VBScript) file

.vbe

VBScript Encoded Script file

.vbs

VBScript file

.vsix

Visual Studio Extension

.ws

Windows Script file

.wsc

Windows Script Component

.wsf

Windows Script file

.wsh

Windows Script Host settings file

.xamlx

Visual Studio Workflow service file

Filenames that include braces (for example, filename.{doc}) are blocked automatically.

Add or remove blocked files to SharePoint 2013 and 2010

If you have farm administrator permissions, you can add or remove blocked file types.

  1. Open SharePoint Central Administration.

  2. Click Security, and then click Define blocked file types.

    Set blocked files from central administration security
  3. To change the web application, click the link next to Web Application: and then click Change Web Application.

    Change web app option

    In the Select Web Application dialog, click an app.

    Select an web app from the change web app page
  4. On the Blocked File Types page do one of the following:

    To add a file to block, type a file extension (with the period), one per line.

    To stop blocking a file, select the file extension and press the Del key.

    tk

    If you delete the wrong file by accident, press CTRL + Z to undo.

    Note: You do not have to type a file name extension in the list in alphabetical order. The next time that you open the list, the file name extension you added will be correctly sorted in alphabetical order.

  5. Click OK.

We're listening

Was this article helpful? If so, please let us know at the bottom of this page. If it wasn't helpful, let us know what was confusing or missing. Please be as specific as possible, and include your SharePoint, OS, and Browser version. We'll use your feedback to fix errors and update this article.

Was this information helpful?

Great! Any other feedback?

How can we improve it?

Thank you for your feedback!

×