Filedrop turns your Joomla site into a file transfer service. A visitor drags files onto a page, fills in whatever you ask of them, and gets a download link that expires on your terms. No account needed, no upload limit imposed by someone else's free tier, and no file leaving infrastructure you control.

It is built for the case where sending a large file through a public transfer service is not an option: client work under NDA, medical or legal documents, anything covered by a data processing agreement that names your own hosting and nobody else's.

Files stay where you put them
Keep your files under your control. Store them on your own Joomla server or send them directly to your own FTP, FTPS or SFTP server, never through a third-party cloud. Filedrop connects to storage with a password or an SFTP private key, and you decide the folder structure with placeholders for the uploader's username, their name, and the upload date.

Before any visitor depends on those settings, a connection check runs seven tests against them: the PHP extension on your server, DNS, the port, the private key pair, the login, the target folder, and finally a real write test that stores and removes a test file through exactly the same code an upload uses. Green all the way down means uploads will work.

Large files, without the timeouts
Uploads travel in chunks, so your server's per-request upload limit only has to fit one chunk instead of the whole file. The chunk size and the maximum transfer size are both yours to set, and the size limit is enforced while the upload runs rather than after the last byte arrives. Several files are bundled into one archive automatically; a single archive that is already zipped is passed through under its own name.

Links that stop working
Every transfer gets a download link built on a token generated from 32 bytes of cryptographic randomness. On top of that you can require a password, set an expiry in days, and cap the number of downloads. Reach the cap and the transfer deletes itself, files included. A scheduled task cleans up whatever has expired, sweeps abandoned upload fragments, and warns you by e-mail when your storage quota fills up.

The form asks exactly what you want
Sender name, e-mail address, recipients, message, expiry, download limit and password can each be shown, required, or hidden. Hidden fields fall back to a default value you configure, enforced on the server so it cannot be worked around by calling the upload endpoint directly. Defaults understand placeholders for the logged-in visitor's name, username and e-mail address, so an internal page can fill itself in.

Run more than one upload page and each menu item can carry its own field settings, with the component options as the fallback. A public page can ask for a sender e-mail while an internal page hides it and fills it in from the account.

Built to survive the open internet

• Rate limiting per IP address, with a configurable window
• A cap on how many recipients one transfer may notify
• An optional site-wide password before anonymous visitors see the form at all
• Captcha support through Joomla's own captcha plugins
• Allow or block lists for file extensions
• Throttled password attempts on both the transfer password and the access gate
• A deny-all .htaccess and web.config in the storage folder, with a warning in the settings when that folder sits inside your web root

Joomla, not a bolted-on app
Notification e-mails run through Joomla's Mail Templates, so you edit the wording under System, Mail Templates like any other Joomla message. Transfer activity is recorded in Joomla's own User Actions Log through an included plugin. Logged-in users get a My Transfers page listing what they sent and received, with a delete button for their own transfers. Two site modules put the upload form or that list in any module position.

What you install
One package containing the component, two site modules, a scheduled task plugin for cleanup, and an action log plugin. The interface ships in English, Dutch, German, French, Spanish and Italian.