ContentSettings Metadata Type in SFDX

Architectural Overview#

Salesforce Files (ContentDocument, ContentVersion, ContentDocumentLink, and ContentDistribution) form the unified document storage architecture across Sales Cloud, Service Cloud, and Experience Cloud. However, unconfigured file sharing settings can easily create data exfiltration paths—such as unauthenticated public links (ContentDistribution) without expiration dates or passwords, or unindexed attachment uploads.

The ContentSettings metadata type (Content.settings-meta.xml) gives architects declarative control over Salesforce Files, CRM Content Libraries (ContentWorkspace), Content Deliveries, and Asset File generation. Version-controlling Content.settings-meta.xml ensures every sandbox, scratch org, and production environment enforces identical document security policies.

SFDX Directory and File Suffix#

Key Metadata Fields#

The ContentSettings metadata schema controls both legacy CRM Content features and modern Lightning Files / Content Delivery policies.

Declarative XML Example#

Below is a security-hardened Content.settings-meta.xml file that routes Notes & Attachments uploads into Salesforce Files, restricts accidental exposure of internal user files in Experience Cloud portals, and bypasses custom file triggers during ContentAsset metadata deployments.

<?xml version="1.0" encoding="UTF-8"?>
<ContentSettings xmlns="http://soap.sforce.com/2006/04/metadata">
    <enableChatterFileLink>true</enableChatterFileLink>
    <enableContent>true</enableContent>
    <enableContentAutoAssign>false</enableContentAutoAssign>
    <enableContentDistPwOptionsBit1>true</enableContentDistPwOptionsBit1>
    <enableContentDistPwOptionsBit2>true</enableContentDistPwOptionsBit2>
    <enableContentDistributions>true</enableContentDistributions>
    <enableContentSupportMultiLanguage>true</enableContentSupportMultiLanguage>
    <enableFilesUsrShareNetRestricted>true</enableFilesUsrShareNetRestricted>
    <enableLibraryManagedFiles>true</enableLibraryManagedFiles>
    <enableUploadFilesOnAttachments>true</enableUploadFilesOnAttachments>
    <skipContentAssetTriggers>true</skipContentAssetTriggers>
</ContentSettings>

package.xml Manifest#

Reference ContentSettings under the Settings metadata type with member Content:

<?xml version="1.0" encoding="UTF-8"?>
<Package xmlns="http://soap.sforce.com/2006/04/metadata">
    <types>
        <members>Content</members>
        <name>Settings</name>
    </types>
    <version>68.0</version>
</Package>

Auditing File Sharing & Retrieving via SFDX CLI#

In addition to managing Content.settings-meta.xml via CLI, architects should periodically run SOQL queries against ContentDistribution to audit active public links created under these settings.

1. Audit Unprotected Public File Links (ContentDistribution)#

SELECT Id, Name, ContentDocumentId, DistributionPublicUrl,
       PreferencesPasswordRequired, PreferencesExpires, ExpiryDate, ViewCount, CreatedBy.Username
FROM ContentDistribution
WHERE PreferencesPasswordRequired = false
ORDER BY ViewCount DESC
LIMIT 100

2. SFDX CLI Retrieve and Deploy Commands#

# Retrieve ContentSettings from the active org
sf project retrieve start --metadata Settings:Content

# Deploy ContentSettings to enforce file security and library settings
sf project deploy start --metadata Settings:Content

Architect Best Practices and Gotchas#

• Enforce Passwords on Public Links: Setting both enableContentDistPwOptionsBit1 and enableContentDistPwOptionsBit2 to true forces password protection to Required for all Content Deliveries (PreferencesPasswordRequired = true), preventing unauthenticated link scraping.
• Experience Cloud File Leakage (enableFilesUsrShareNetRestricted): Always set enableFilesUsrShareNetRestricted to true when external Experience Cloud sites exist. Without it, files posted to a user’s profile or shared broadly with the internal company group can become visible to external portal users who have access to the user record.
• Attachment Migration (enableUploadFilesOnAttachments): Enabling enableUploadFilesOnAttachments ensures that even if a legacy page layout still includes the “Notes & Attachments” related list, clicking “Upload Files” creates a ContentVersion / ContentDocumentLink rather than a legacy binary Attachment.

Frequently asked questions

What security risks does ContentSettings mitigate in Salesforce?

ContentSettings controls whether public Content Deliveries require password protection by default, prevents guest users from uploading files blindly, and enforces how potentially dangerous file extensions (like SVG or HTML) are served by the browser.

Where is ContentSettings stored in SFDX format?

It is stored at force-app/main/default/settings/Content.settings-meta.xml and referenced in package.xml under the Settings metadata type with member Content.

How does enableChatterFileLink affect record sharing?

When enableChatterFileLink and Content Deliveries are enabled, users with appropriate permissions can generate external public URLs (ContentDistribution records) that expose a file outside Salesforce record-level sharing.

Can ContentSettings enable Salesforce CRM Content Libraries automatically?

Yes, setting enableContent to true enables Salesforce CRM Content workspaces (ContentWorkspace) and library permission structures across the org.