Uploader

This guide covers a full Uploader install on Apache plus PHP 8.2 and MySQL or MariaDB, then every admin screen. Use it when you first set the script up and when you change settings later.

Overview

Uploader is a PHP script for building your own file upload website. A visitor uploads a file, receives a short link such as https://example.com/abc12, and anyone with that link can open the file page and download.

• Public pages: upload, recent, popular, file details, Privacy, Terms, and DMCA.
• Admin panel (default path /manage/): files, site, uploads, admin URL, account, and ads.
• Light and dark mode, plus theme colors you pick in Site settings.
• HTTPS enforcement on a public https:// site URL, including Cloudflare and nginx proxies.

What ships in the package

• Public pages, upload handler, and shared PHP in the site root.
• assets/ for CSS and JavaScript.
• files/ for stored uploads (empty until someone uploads). Keep this folder.
• inc/ for shared layout pieces.
• install/ for first-run setup. Delete it after a successful install.
• manage/ as the default admin folder (or the path you choose during setup).
• .htaccess for pretty links, error pages, and folder protection.
• README.txt with a short install checklist.

Setup writes a generated settings file in the site folder. That file is not in the zip. Do not share it after it exists.

Requirements

• PHP 8.2 or newer
• Apache with mod_rewrite and .htaccess allowed
• MySQL or MariaDB
• PHP extensions: mysqli, fileinfo, json, session
• The site folder and the files folder must be writable
• SSL certificate on a public host (Let's Encrypt or your panel)

PHP also limits upload size. If visitors send large files, raise upload_max_filesize and post_max_size in PHP (and matching Apache limits) to at least the size you set in Uploads. The script default max is 256 MB, and it will not go above the PHP limit.

Install

1. Upload the files

Upload the whole script folder to the domain root or a subfolder such as /uploader/. Keep the folder structure as shipped. Do not skip the empty files folder.

2. Create a database

Create an empty MySQL or MariaDB database, or use an account that can create one. Note the host (often localhost), database name, username, and password. Only letters, numbers, and underscores are allowed in the database name.

3. Turn on HTTPS

Install an SSL certificate and force HTTPS at the host or Cloudflare if you use a proxy. The installer requires an https:// site URL on a public hostname.

4. Open setup

Visit https://your-domain.com/install/ (add the subfolder if you used one). Setup checks PHP 8.2+, fileinfo, a writable files/ folder, and a writable site folder. All four must pass before the form can run.

5. Fill the form

Reserved admin paths you cannot use: recent, popular, privacy, tos, dmca, install, files, assets, inc, upload, 404, 403.

If setup finds a previous install, tick the confirmation box. That overwrites site and admin settings. Uploaded files stay unless you delete them yourself.

6. Finish

After a successful save you will see a reminder to delete the install folder. Do that before you share the site. Then open the site and the admin URL shown on the success screen.

After setup

• Sign in at /manage/ (or the path you chose) using admin.php or the folder index.
• Set the contact email on Account. Password reset and Google sign-in both use that address.
• On Uploads, pick allowed types, max size, the hourly cap, and any blocked words.
• On Site, add a logo and theme color if you want.
• On a VPS, confirm the mail server can send from PHP if you want forgot-password emails.

Settings are stored in a generated file in the site folder. Do not share that file. It holds the database password and the admin password hash.

Public site

Upload

The homepage is the drop zone. Visitors can drag a file or click Select files. Several files can be queued. The same filename can be uploaded more than once. Each upload gets a new short alias.

Rejected uploads show a clear message (type, size, blocked word, or too many uploads). Successful uploads show Open link.

Short links

Each file gets a 5-character alias. Visitors use:

• /abc12 for the file page
• /abc12/dl to start a download

Downloads support HTTP Range, so download managers can resume. Hits increment when someone downloads. The stored filename on disk is a random name. The original name is used in the download header.

File page

Shows name, size, type, upload time, download count, last download, and upload location (city and country when the IP is public; otherwise Local network). Visitors can copy the share link. Ads can appear above or below the details if you enable them. Ads never show on the homepage.

Recent and Popular

/recent/ lists the latest 50 files. /popular/ lists the 50 most downloaded. On a phone, those tables show File and Size so a long name does not crush the size column.

Legal and theme

Footer links: Privacy, Terms of Service, DMCA. Those pages keep a last-updated line under the title. The footer also has a light/dark toggle. The choice is stored in the browser. Theme color comes from Site settings and tints accents and backgrounds in both modes.

Admin panel

Open https://your-domain.com/manage/ (or your custom path). The login card is standalone. It follows the site theme and dark mode, and stays a fixed width so an error message does not stretch the form.

• Username and password you set during install or on Account.
• Forgot password emails a one-hour reset link to the contact email on Account. The server must be able to send mail (PHP mail()). Set up a working MTA and SPF for your domain.
• Captcha (optional): Google reCAPTCHA v2 or Cloudflare Turnstile. Configure keys on Admin URL.
• Google sign-in (optional): only the Google account whose email matches the contact email can sign in. Create a Web application OAuth client and add the redirect URI shown on the Admin URL page.

Too many failed logins or reset requests are rate limited. After a successful login you land on Files.

Sidebar

• Files for the upload list.
• Settings opens Site, Uploads, Admin URL, Account, and Ads.
• View site opens the public homepage in a new tab.
• Log out ends the session.

The sidebar and top bar follow the public theme color and dark mode. The theme toggle sits in the admin chrome the same way it does on the public site. On a phone the brand mark stays readable in the compact header.

Files

Open Files in the sidebar. You see name, size, downloads, and upload time. 100 files per page, newest first. Pagination stays on the same page after a delete.

• Open a file by clicking the name (new tab from the public URL).
• Delete on one row asks for confirm in the site dialog (not the browser confirm). The disk file and the database row are both removed.
• Delete selected removes up to 10 files at once. The header checkbox selects the first 10 on that page. An 11th tick is ignored.

Use View site in the sidebar footer to open the public site in a new tab.

Site settings

Settings → Site

• Website title and Website URL. Changing the URL updates public links, the manifest, and error-page paths. A public URL must be https://.
• Custom logo: JPG, PNG, GIF, WEBP, or SVG, maximum 2 MB. Replaces the header mark. You can remove it later.
• Theme color: Default, Navy, Blue, Green, Orange, Red, Violet. Applies to the public site and admin (accents, buttons, sidebar, brand mark).

Database on the same page:

• Optimize tables reclaims unused space. Safe. Can take a moment with many files.
• Repair tables if a table looks damaged. Confirm in the dialog first.

Those actions run on the files table and the ads table (with your prefix).

Upload settings

Settings → Uploads

• Max file size (MB): at least 1. Capped by the PHP upload limit shown on the form.
• Upload cap: successful uploads allowed from one address in the period below. Default 30. Use 0 for no cap. Range 0 to 10000. Failed tries do not count.
• Cap period (hours): 1 to 168 (7 days). Default 1. After this window the count resets.
• Allowed file types: tick at least one. Groups include archives (ZIP, RAR, 7Z, GZ, BZ2, XZ, TAR), media (MP4, WEBM, MKV, MP3, WAV), apps (APK, EXE), documents (PDF, DOCX, XLSX, PPTX), images (JPG, JPEG, PNG, GIF, WEBP), and text (TXT, CSV). Dangerous types such as PHP, HTML, JS, and SVG cannot be enabled.
• Blocked words: one per line or commas, up to 200 words, 40 characters each. Matching is not case sensitive. Checked in the filename and inside TXT and CSV content.

The public homepage lists the allowed types and the max size you save here.

Admin URL

Settings → Admin URL

Change the path (for example from manage to panel). After you save, the old path stops working. Bookmark the new address. The script creates the new folder for you.

On the same page:

• Login captcha: None, reCAPTCHA v2, or Turnstile. When None is selected, key fields stay hidden. Obtain reCAPTCHA keys at Google reCAPTCHA admin (v2 checkbox). Obtain Turnstile keys at Cloudflare Turnstile.
• Google sign-in: enable and paste the client ID and secret. Add the exact redirect URI printed on that page to your Google Cloud OAuth client.

Account

Settings → Account

• Change admin username and password.
• Set the contact email used for legal pages, password reset, and the allowed Google account.

If you change the password, sign in again with the new one.

Ads

Settings → Ads

• Display ads: master on/off. When off, no site ads render.
• ads.txt: saved as a file at the site root for ad networks. Leave empty and save to remove it. The public URL is shown on the form.
• Header ad: above content on inner pages. Not shown on the homepage.
• File details ad: on the file page, above the download button.
• Footer ad: above the site footer on inner pages. Not shown on the homepage.
• Ads table: create or repair the ads table if it is missing.

Paste HTML or script tags from your ad network. Preview on Recent, Popular, or a file page, not on the upload homepage.

HTTPS

• A public site URL must start with https://. The installer and Site settings reject http://example.com.
• http://localhost and private LAN addresses can stay on HTTP for local testing.
• When the saved site URL is HTTPS, HTTP visits redirect to HTTPS. The script also reads X-Forwarded-Proto and Cloudflare visitor headers, so a proxy in front of Apache still counts as HTTPS.
• Admin session cookies use the Secure flag on HTTPS.
• On a public HTTPS site the script sends HSTS (about 180 days) so browsers keep using HTTPS.

You still need a real certificate on the server or at Cloudflare. The script cannot issue the certificate for you.

Backup and move

A full backup is the site folder plus a MySQL dump of the database (tables use your prefix, default up_).

• Copy the whole site folder, including files/ and the generated settings file.
• Export the database from phpMyAdmin or mysqldump.
• To restore, put the folder on the new host, import the dump, then open Site and save the new Website URL if the domain or folder changed.
• If you move from a subfolder to the domain root (or the other way), update the Website URL and confirm pretty links still work.

Changing only the admin path does not move files. Changing the Website URL does not move the database. Do those two steps yourself when you relocate the host.

Security

• Delete the install folder after setup.
• Use a strong admin password and a hard-to-guess admin path.
• Do not share the generated settings file from the site folder.
• The files folder is not listable. Downloads go through the short link only.
• Uploaded files are stored under random names. PHP and other script extensions are blocked.
• CSRF tokens protect admin forms. Deletes use the in-site confirm dialog.
• Rate limits apply to uploads (per address) and to login or reset attempts.

Troubleshooting

Need help?

Read this page from install through the admin screens first. If something still fails, note the exact URL, the message on screen, and your PHP version.

Contact us on the support page.