Salesforce allows you to upload various types of documents. These documents can be uploaded in the notes and attachments section of any record or in the documents section. Uploading HTML can be a security risk (due to an XSS attack), and for security reasons, your organization may prohibit this type of document upload to Salesforce. Once this feature is enabled, it doesn't allow users to upload a file with any of these extensions: htm, html, htt, htx, mhtm, mhtml, shtm, shtml, and acgi. These settings won't affect the previously-uploaded HTML documents and attachments, but when users try to view an HTML attachment or document, their browser first prompts them to open the file in the browser, save it to their computer, or cancel the action. This feature won't affect the attached HTML document on e-mail templates.

To prohibit the uploading of HTML attachments and documents, follow these steps: