scan.now
Premium Scan a site

Find File Upload Forms on a Web Page

Enter a page that may accept uploads. Scan.now inventories file-input forms and their public actions without selecting or submitting a file.

Enter the exact public page to inspect. No form is submitted and no data is modified.

A registered account is required to run this test. Finding status, evidence, affected locations and remediation are Premium-only. How active scanning works · Acceptable use

Treat every file upload as a boundary, not a form field

An upload crosses several trust boundaries at once: the filename is user input, the declared content type is a claim, parsers may process complex data, and the stored object may later be served to another user. A secure design constrains all four stages.

Scan.now inventories public forms containing file inputs, their actions and named fields. It does not create, select or upload a file. The result is therefore an attack-surface checklist: it tells a webmaster where a deeper authorised upload review belongs without placing content on the server.

Put this result in context

This scanner answers one part of the review. Continue with Path Traversal Scanner for verify whether path-like parameters return local files, then API Surface Scanner for inventory api hints, openapi documents and route counts. These are separate checks because a strong result here does not prove that the adjacent surface is healthy.

For the background behind these signals, read Website Security: What a Vulnerability Scan Looks For and How to Fix It and What Is a Vulnerability Scan? Types, Limits and What the Results Mean. The File-upload surface inventory check reference explains the exact test, evidence and remediation used in the report. The Scan.now methodology explains request limits, scan boundaries and what the scanner deliberately does not attempt.

Upload forms and fields examined on the page

The check is deliberately bounded to the signals below.

Coverage areaWhat the scanner examines
Public file inputsHTML file controls and their enclosing form actions are identified from the entered page.
Supporting fieldsNamed fields, method and visible form structure help distinguish avatars, documents, imports and other workflows.
Zero-byte impactNo sample, test image, archive or executable is generated or transmitted.

Discovered inputs and pages without upload forms

A scan result is evidence with a boundary, not a guarantee about every route.

Upload surface found

Add the action to the security inventory and verify validation, storage, authorisation, serving and parser isolation end to end.

No upload form found

The returned HTML contains no file input. Drag-and-drop widgets, dynamically rendered controls, APIs and mobile uploads may still exist.

Informational result

Discovering an upload is not a vulnerability; it identifies a high-value boundary that deserves stronger controls and tests.

Validate, rename and isolate uploaded files

Use the recommendations below to address confirmed findings and strengthen the surrounding control.

  1. Validate content, not only names

    Allow-list expected formats and inspect magic bytes and parsed structure; do not trust the extension or browser Content-Type.

  2. Generate the storage name

    Discard path components and store under a server-generated identifier outside the executable web root.

  3. Set strict size and complexity limits

    Bound bytes, dimensions, archive members, nesting, decompression ratio and parser time before expensive processing.

  4. Scan and isolate processing

    Use maintained parsers in a restricted worker, malware scanning where appropriate, and no outbound network access by default.

  5. Serve as inert content

    Apply a safe Content-Type, Content-Disposition: attachment where suitable, nosniff, separate origin and per-object authorisation.

How it works

  1. Enter the upload page

    Use the exact public page where an avatar, document, import or attachment can be selected.

  2. We inventory the form

    File controls, action, method and named fields are recorded without choosing a file.

  3. Review the whole lifecycle

    Use the result to verify validation, isolated processing, storage, serving and deletion controls.

What this tool checks

1 checks across 1 areas. Each links to its reference page with the test, the risk and the fix.

Full reference

Page content and JavaScript

1 check

The ones that most often decide the grade:

Info File-upload surface inventoryFile-upload forms discovered; no files are submitted by this scan.

Related tools

Continue the review with four checks that cover adjacent parts of the same attack surface.

All tools
Active Security Path Traversal Scanner

Verify whether path-like parameters return local files
Active Security API Surface Scanner

Inventory API hints, OpenAPI documents and route counts
Files File Malware Scanner

Malware in documents and archives
Websites Website Vulnerability Scanner

Headers, TLS, cookies, exposed files

Guides for this tool

Background reading written to go with these results.

13 min read · Updated Sep 13, 2026 Website Security: What a Vulnerability Scan Looks For and How to Fix It

A website vulnerability scan checks the parts of a site an attacker can reach without logging in: Transport security, HTTP headers,...

Read the guide
8 min read · Updated Sep 12, 2026 What Is a Vulnerability Scan? Types, Limits and What the Results Mean

A vulnerability scan checks a system against a list of known weaknesses and reports what matches. The types of scan, the difference...

Read the guide
8 min read · Updated Sep 14, 2026 Passive vs Active Scanning: What Each Can Find and When Each Is Appropriate

Passive scanning observes normal responses; active scanning sends crafted requests to trigger flaws. The boundary, why it matters...

Read the guide
9 min read · Updated Sep 18, 2026 How to Read a Security Scan Report: Severity, False Positives and What to Fix First

A scan report is a list of findings with severities, and the hard part is deciding what matters. How severities are assigned, how to...

Read the guide

Frequently asked questions

Does this scanner upload a test file?

No. It performs discovery only. Nothing is generated, transmitted or stored on the target.

Why is checking the filename extension insufficient?

The sender controls both the name and declared MIME type. Inspect the actual bytes and parsed structure, then store and serve the result under server-controlled metadata.

Should uploaded images be re-encoded?

Re-encoding through a maintained image library can remove active metadata and malformed structures, but the decoder itself must be patched, isolated and protected by resource limits.

Is antivirus enough for upload security?

No. Malware detection does not enforce ownership, stop path traversal, limit decompression, make HTML inert or prevent a public bucket from exposing private files.