---
title: "Global properties"
source: https://dev.pageseeder.com/guide/configuration/properties/global_properties.html
description: "Global properties configuration for PageSeeder server stored in global.properties, covering API settings, email configuration, security, performance tuning, licensing, and role-based access overrides."
last_updated: 2026-09-08T14:07:46+10:00
tokens: ~4862
---

# Global properties

The global properties apply to the entire PageSeeder server.

These values, stored in `global.properties`, can be found in:

```text
WEB-INF/config
```

| **Property** | **Description** | **Default value** |
| --- | --- | --- |
| `apiAccountIPs` | Comma-separated list of IP addresses for API accounts (`apiAccountUsernames`). *Doesn’t apply to OAuth client\_credentials.* |  |
| `apiAccountUsernames` | Comma-separated list of API account usernames. API account passwords cannot be reset. `apiAccountIPs` **must** also be set for API user accounts |  |
| `apiPort` | HTTP port for the Publish Engine to communicate with PageSeeder | `8282` |
| `attachmentSubDir` | The group folder name to store email attachments | **`attachments`** |
| `autoResponderLimit` | Allowed number of email messages to the same location within the auto responder time (`autoResponderMinutes`) before sending warning emails | **`25`** |
| `autoResponderMinutes` | Reaching the auto responder limit (`autoResponderLimit`) in less than this period triggers warning email | **`90`** |
| `autoResponderReplyLimit` | Allowed number of email replies allowed to the same thread within the auto responder time (`autoResponderMinutes`) before sending warning emails | **`10`** |
| `autoResponderWarnings` | How many emails with warnings to accept before rejecting comments | **`5`** |
| `cacheDiskSize` | Maximum disk space in MB used by EHCache (minimum `1024`). *Requires PageSeeder v6.3 or higher*. | `16384` |
| `csrfMode` | Cross-Site Request Forgery protection. Allowed values: `enforce`, `partial`, `disable` with optional `-log` suffix. *Requires PageSeeder v6.2 or higher (see note 3).* | `partial-log` |
| `debounceIndexingDelay` | The number of milliseconds to wait before indexing an object. *Requires PageSeeder v6.3 or higher.* | `500` |
| `debouncePublicationDelay` | The number of milliseconds to wait before updating publication TOC. *Requires PageSeeder v6.3 or higher.* | `500` |
| `defaultMinimalUI` | If `true` members who have not set a user interface preference will default to using the minimal layout. *Requires PageSeeder v6.1 or higher.* | `false` ** ** |
| `diffXMaxEvents` | Maximum size of number of words multiplied by number of compare words when diffing content in history and matrix algorithm is required | `4M` |
| `disableDefaultDKIM` | If `true` outgoing emails are not signed with the pageseeder.com DKIM (use if your SMTP server does the signing). *Requires PageSeeder v6 or higher.* | `false` ** ** |
| `documentFolder` | Path on host file system for storing documents. If no value is specified, the folder used is: `[pageseeder install]/documents` |  |
| `emailDomain` | The domain designated for email sent to and from the PageSeeder server. Also, the domain in the user interface. If set to `pshosts`, email uses the domain of the default folder for the group. If blank incoming email is disabled. |  |
| `emailEmbedImages` | A boolean indicating that images in outgoing emails should be embedded as attachments – useful for intranet testing (always done when `webSiteAddress=``localhost` or `*.localhost`) | `false` |
| `emailMaxThreadMessages` | If the number of recipients for a notification is more than this, the emails are sent in the background | **`20`** |
| `emailSenderDomain` | This can send PageSeeder emails from a different domain than that in the user interface. However, with any version more recent than 5.97, the  [organization config](/guide/configuration/organization_customization.md) is a better way of doing this |  |
| `errorReportGroup` | The name of a group that will accept emails in the error report format even if the sender is not a group member, see `errorReportAddress` group property. *Requires PageSeeder v6.2 or higher.* |  |
| `forbiddenAttachmentExtensions` | Comma-separated list of extensions for filenames that can’t be attached to comments as they might be harmful. *Requires PageSeeder v6 or higher.* | \[see note 1\] |
| `forbiddenUploadExtensions` | Comma-separated list of extensions for filenames that can’t be uploaded by non-administrators as they might be harmful. *Requires PageSeeder v6 or higher.* | \[see note 1\] |
| `globalTemplate` | The name of a project that an administrator designates to provide the base settings for all other projects on the server.  |  |
| `groups` | Number of groups allowed by PageSeeder license | `unlimited` |
| `licenseExpires` | The date when the PageSeeder license expires (ISO 8859 format YYYY-MM-DD). |  |
| `logsAccessHistory` | Positive integer corresponding to the number of days the access log history is kept | `7` |
| `logsAccessLevel` | **Must** be one of DEBUG, INFO, WARN, ERROR, OFF. Use DEBUG or INFO to log all access.Use WARN to only log access that generates HTTP status code \>= 400.Use ERROR to only log access that generates HTTP status code \>= 500.Use OFF to not log any access. | `INFO` |
| `logsFolder`   | Absolute folder path for log files. If no value is set, the following folder is used: `pageseeder/webapp/WEB-INF/state/logs` |  |
| `mailIp` | IP address the PageSeeder email server is bound to, if not all IPs |  |
| `mailPort` | Port for PageSeeder email server | **`25`** |
| `mailServer` | A boolean indicating that the PageSeeder mail server should be enabled | **`true`** |
| `mailTlsCertificate` | Absolute folder path to certificate for TLS on incoming email (e.g. `/etc/nginx/ssl/pageseeder/mydomain.crt` or `/mycertmanager/mydomain/fullchain.pem`).  *Requires PageSeeder v6.1 or higher (see note 2).* | ** ** |
| `mailTlsKey` | Absolute folder path to private key for TLS on incoming email - no passphrase (e.g. `/etc/nginx/ssl/pageseeder/mydomain.key` or `/mycertmanager/mydomain/privkey.pem`). *Requires PageSeeder v6.1 or higher (see note 2).* | ** ** |
| `mailTlsRequired` | A boolean indicating that TLS must be used (requires `mailTlsKey` and` mailTlsCertificate`). *Requires PageSeeder v6.1 or higher.* | `false`** ** |
| `malwareMaxEmailThreads` | The maximum number of email threads that can scan for malware simultaneously - `0` disables email scanning. Must not be larger than ClamAV `MaxThreads` (e.g. `10`). Larger numbers may require increasing database `MaxConnections`. *Requires *`malwareScanner`* property and PageSeeder v6.2 or higher.* | **`0`** |
| `malwareScanner` | The `[host]:[port]` for the ClamAV malware scanner (e.g. `localhost:3310`). *Requires PageSeeder v6.2 or higher (see note 4).* | ** ** |
| `malwareScanUIOnly` | A boolean indicating that only files uploaded via the user interface are scanned for malware (i.e. requests without an OAuth token). *Requires PageSeeder v6.2006 or higher* | **`false`** |
| `manualTokenCreation` | A boolean indicating that administrators can manually issue tokens and authorization codes. *Requires PageSeeder v6 or higher.* | **`false`** |
| `maxAccountLockout` | The maximum number of minutes an account or authenticator can be locked for | `60` |
| `maxAttachmentNumber` | The maximum number of files that can be attached to a comment in the web interface | `20` |
| `maxAttachmentSize` | The maximum number of bytes allowed for an attachment in a notification email | **`10M`** |
| `maxAutosuggestPrefixes` | The maximum number of prefixes in the auto-suggest query, if too high, auto-suggest fails with “maxClauseCount” error when querying small terms in big indexes (should be less than 1000). *Requires PageSeeder v6 or higher.* | `800`** ** |
| `maxBadLogins` | The maximum number of incorrect login attempts before an account is locked | `10` |
| `maxFacetSize` | The maximum number of facets that can be returned in a search result | `1000` |
| `maxForwardXRefs` | The maximum number of forward XRefs in a PSML document | `3000` |
| `maxIndexingSize` | Upper threshold number of bytes for non-PSML files to have their content indexed. For DOCX files, this number is for the uncompressed size of the `document.xml` file | `30M` |
| `maxIndexingThreads` | The maximum number of indexing threads. More threads increases indexing speed but should not exceed the number of CPUs on the server | `2` |
| `maxOpenedIndexes` | The maximum number of open indexes at any one time | `50` |
| `maxPageSize` | The absolute maximum number of search results returned per page | `10000` |
| `maxReverseXRefs` | The maximum number of reverse XRefs that are output in a PSML document (**must** not be more than `maxPageSize`) | `1000` |
| `maxUploadNotificationAttachments` | The maximum number of document attachments on an upload notification (if more than this, then none are attached to the notification – there is no limit for email attachments) | **`20`** |
| `maxUploadSize` | The maximum size in bytes to upload a single file. To support more than 1GB, update [Nginx](/guide/installation/configuring_a_proxy.md) `client_max_body_size`. Exceeding the size value generates an error: `Request Entity Too Large` | `100M` |
| `maxVersionNotifications` | The maximum number of notifications when adding bulk versions by upload, folder or search (if more than this, then none are sent) | `20` |
| `maxWorkflowNotifications` | The maximum number of notifications when adding bulk workflows by upload, folder or search (if more than this, then none are sent) | `20` |
| `members` | Number of groups allowed by PageSeeder license or **unlimited** | `unlimited` |
| `mfaDisable` | A boolean indicating that MFA is disabled for sign-in. *Requires PageSeeder v6.2 or higher.* | `false` |
| `mfaSupport` | Comma-separated list of supported MFA (multi-factor authentication) types. *Requires PageSeeder v6.2 or higher.* Allowed values: `email-otp`: Email code`sms-otp`: SMS code`totp`: TOTP authenticator apps`recovery`: Backup codes`webauthn`: WebAuthn (devices, Yubikeys, Passkeys) Existing WebAuthn authenticators will fail if `webSiteAddress` is changed. | `email-otp,totp,recovery,webauthn` |
| `minAccountLockout` | The minimum number of minutes an account or authenticator can be locked for | `30` |
| `minBadLogins` | The minimum number of incorrect logins before an account is locked | `5` |
| `notifyDailyTime` | Time in 24 hour format when daily and weekly comment digests are sent out. *Requires restart.* | `23:59` |
| `notifyProcess` | A boolean indicating that daily comment notifications should be enabled. *Requires restart.* | **`true`** |
| `notifyWeeklyDay` | The day that weekly comment notifications are sent out (they are sent at the `notifyDailyTime`) – **must** be `monday, tuesday, wednesday, thursday, friday, saturday` or `sunday` | **`sunday`** |
| `outOfOfficeLimit` | Number of emails matching outOfOfficeString allowed before member is set to 'on vacation' | **`2`** |
| `outOfOfficeString` | Comma-separated list of strings to look for in email subject | **`out of the office,out of office`** |
| `passwordAlgorithm` | The algorithm for hashing passwords – **must** be `sN` or `pN` where N \>=0 (weakest/fastest) and N\<=9 (strongest/slowest) or `a[t]:[m]:[p]` where:    `t` is the number of iterations,    `m` is the memory limit in MB,    `p`  is the parallelism (e.g. `a3:20:2`). *The `p` and `a` prefixes use the Argon algorithm and require PageSeeder v6.2.* | **`p5`** |
| `productKey` | Product key for PageSeeder license | `dev` |
| `profiling` | Number of milliseconds a database query can take before it is logged as a slow query | **`5000`** |
| `projects` | Number of projects allowed by PageSeeder license or **unlimited** | `unlimited` |
| `publishEngineUrl` | URL to use the Publish Engine on a different PageSeeder server. For example: `http://myserver.com/ps/api/publisher` |  |
| `reminderMaxEmails` | The maximum number of reminder emails allowed to be sent every Monday. *Requires restart and PageSeeder v6.2 or higher.* | `2000` |
| `reminderNotification` | If 'true' enable sending of reminder emails. *Requires restart and PageSeeder v6.2 or higher.* | `false` |
| `reminderStatuses` | Comma separated list of statuses a task/workflow must have to be in reminders. *Requires restart and PageSeeder v6.2 or higher.* | `Open,Initiated, In Progress, Complete`  |
| `reminderTime` | Time in 24 hour format to start sending reminders every Monday. *Requires PageSeeder v6.2 or higher.* | `04:00` |
| `serviceStrict` | If `true` an HTTP error is returned for deprecated or non-released services. If `log` only a warning is logged. | `log` |
| `sessionTimeout` | If a user has not accessed PageSeeder for this many minutes they are signed out automatically (unless they ticked remember me). *Requires PageSeeder v6 or higher.* | `120`** ** |
| `sitePrefix` | The path of the PageSeeder app as defined in the Web configuration (web.xml) | `/ps` |
| `slowIndexingSize` | Non-PSML files with larger than this number of bytes join the slow indexing queue to conserve memory | `1M` |
| `smsProvider` | The name of the SMS provider for MFA. *Requires PageSeeder v6.2 or higher.* |  |
| `smsProviderApiKey` | The SMS API key for MFA. *Requires PageSeeder v6.2 or higher.* |  |
| `smsProviderApiSecret` | The SMS API secret for MFA. *Requires PageSeeder v6.2 or higher.* |  |
| `smsProviderServiceId` | The SMS API service ID for MFA. *Requires PageSeeder v6.2 or higher.* |  |
| `smtpAsync` | If ‘true’ send all emails asynchronously which can be useful if your SMTP server is slow. Send failures are shown in general and process logs and this property is overridden by the `notify-async` parameter in services. *Requires PageSeeder v6 or higher.* | `false` |
| `smtpServerAddress` | SMTP server to use for outgoing email messages (if blank, outgoing email is disabled) | **`localhost`** |
| `smtpServerPassword` | Password for SMTP authentication of outgoing emails |  |
| `smtpServerPort` | Port of SMTP server to use for outgoing email messages | `25` |
| `smtpServerSSL` | If 'true' connect to SMTP server using SSL for outgoing email messages. *Requires PageSeeder v6 or higher.* | **`false`** |
| `smtpServerSTARTTLS` | If 'true' connect to SMTP server using START TLS for outgoing email messages. *Requires PageSeeder v6 or higher.* | **`false`** |
| `smtpServerUsername` | Username for SMTP authentication of outgoing emails |  |
| `urlRequestDelay` | The delay in seconds between requests to the same domain when validating URLs. *Requires PageSeeder v5.99 or higher.* | `10` |
| `webhookRequestInterval` | The number of seconds to collect webhook events into a batch before sending as a single request (`0` means `0.5` seconds) | `5` |
| `webhookRequestSize` | The maximum number of bytes in a single webhook request (requests are split if they exceed this limit) | `1400` |
| `webhookRetries` | The maximum number of times a failed webhook request is resent before the webhook status is changed to “unreachable” | `12` |
| `webSiteAddress` | Specifies the host of PageSeeder; must be a valid [hostname](https://datatracker.ietf.org/doc/html/rfc3986#section-3.2.2) | `localhost` |
| `webSitePort` | The port to access PageSeeder; must be a valid [port number](https://datatracker.ietf.org/doc/html/rfc3986#section-3.2.3) | `443` |
| `webSiteScheme` | Specifies the URL Scheme used to access PageSeeder. Supported values: **http** or **https** | `https` |

> **Note:** The default value for both `forbiddenAttachmentExtensions` and `forbiddenUploadExtensions` is: `ade,adp,apk,appx,appxbundle,bat,cab,chm,cmd,com,cpl,diagcab,diagcfg,diagpack,dll,dmg,ex,ex_,exe,hta,img,ins,iso,isp,jar,jnlp,js,jse,lib,lnk,mde,msc,msi,msix,msixbundle,msp,mst,nsh,pif,ps1,scr,sct,shb,sys,vb,vbe,vbs,vhd,vxd,wsc,wsf,wsh,xll` On Linux the files referenced in `mailTlsCertificate` and `mailTlsKey` must be accessible to the `pageseeder` user. Ensure that files have `r` permission and all ancestor directories have `rx` permission for the correct group. The `csrfMode` determines if non-GET requests require an `Anti-CSRF-Token` header/parameter as follows: `enforce` means required, `partial` means required except for legacy API requests, `disabled` means not required. The `-log` suffix means that all non-GET requests without the token will be logged as warnings. Malware scanning currently requires a separately installed instance of [ClamAV](https://www.clamav.net/) running that PageSeeder can access via TCP/IP. ClamAV is configured by creating/copying two files as per its documentation: `clamd.conf` (for scanning) and `freshclam.conf` (for automatic updating of its malware database). Properties in `clamd.conf` may need modification, for example increasing `StreamMaxLength` to scan files larger than 100 MB.

> **Note:** - Properties that support multiple values must separate the values with a single comma and no spaces.  - Where properties expect boolean flags, the allowable values are: `true` or `false`. - The default values in this document are for guidance and convenience only; for existing servers, refer to the actual `global.properties` before making any decisions. - As of PageSeeder v6.2 properties with numerical values can contain underscores and end with `K`, `M` or `G` which multiplies them by a thousand, million or giga (e.g. `1_000_000`, `100K`, `2M`, `3G`).

## Role override

These optional properties affect the default functionality assigned to a [role](/reference/glossary/role.md).

> **Note:** - *save-release* is now deprecated, use *create-workflow* instead. - *set-style-owner* on *adminEnable* is now deprecated. - *assign-all-comments* on *reviewerEnable* and *contributorDisable* are now deprecated.

| **Property** | **Allowed values** |
| --- | --- |
| `publicEnable` | self-register |
| `reviewerEnable` | create-workflow |
| `contributorDisable` | edit-comments,archive-comments,manage-documents |
| `managerEnable` | delete-comments,delete-documents |
| `managerDisable` | edit-comments,archive-comments,edit-docids |
| `adminEnable` | delete-comments,delete-documents,delete-members,admin-database,access-personal |

## Deprecated properties

> **Deprecated:** The following properties have been deprecated and are no longer used in the latest version of PageSeeder (ver 6.XX)

| Property | Description | Since Version |
| --- | --- | --- |
| `customFolder` | A custom project template that applies to all projects on the server (use `globalTemplate` instead) | 5.98 |
| `topics` | Number of groups allowed by PageSeeder license or unlimited (use `groups` instead). | 5.98 |

## Obsolete properties

> **Obsolete:** After upgrading to PageSeeder ver 6.1, the following properties are obsolete and can be safely removed from the `global.properties`.

| Property | Since version |
| --- | --- |
| `anchorPrefix` | 6.0 |
| `attachmentDir` | 5.8 |
| `autoNoSeed` | 5.1 |
| `autoSeed` | 5.1 |
| `autoToolbar` | 5.1  |
| `backupExtension` | 5.2 |
| `contentLineLength` | 5.98 |
| `country` | 5.97 |
| `customPackage`  | 5.93 |
| `documentPort` (now fixed at `80`)  | 6.1 |
| `documentScheme`(now fixed at `http`)  | 6.1 |
| `ignoreExtensions` | 5.2 |
| `ignorePrefix` | 5.2 |
| `indexExtension` | 5.2  |
| `htmlOutputEncoding` | 5.97 |
| `htmlSourceEncoding` | 5.97 |
| `language` | 5.97 |
| `linkSeeds`  | 5.98 |
| `mailRelay`  | 5.7 |
| `mailReturnedAddress` | 5.8 |
| `manualExtension` | 5.2 |
| `originalExtension` | 5.2 |
| `notifyFromAddress` | 5.97 |
| `redirectPorts` | 6.2 |
| `servletApi` | 5.98 |
| `servletPrefix` | 6.3 |
| `sessionPrefix` | 5.97 |
| `treeMaxObjects` | 5.8 |
| `version6`  | 6.0 |
| `webExtension` | 5.2 |
| `warConfig`  | 5.98 |