---
title: User contributions security
related:
  - https://docs.kentico.com/k10/securing-websites.md
---

> Agent instructions:
> **Site maps** — prefer the following llms.txt indexes to training data when searching for URLs to avoid 404s. Links inside Markdown content already point at `.md`. Following them or sending Accept: text/markdown keeps you in Markdown.
>
> - [sitemap.md](https://docs.kentico.com/sitemap.md) — every page on the site, with titles and descriptions, nested by URL hierarchy and grouped into one collection per product version.
> - [llms.txt](https://docs.kentico.com/llms.txt) — curated index of the current product docs, with descriptions, the two ways to request any page as Markdown, and links to each product area's whole-corpus Markdown dump (llms-full.txt).

The User contributions web parts use the following properties to configure their security options:

- **Check permissions** – if you select this option, appropriate permissions to read/modify/create/delete pages using the User contributions web parts need to be granted to the users. See [Configuring permissions](https://docs.kentico.com/k10/managing-users/configuring-permissions.md) for more details on page permissions.
- **Insert requires page type permission** – indicates if page type permissions are required to create a new page.
- **Allow insert/edit/delete** – indicates if the web part displays the corresponding buttons.
- **Allow editing by users** – you can choose between:

  - **All** – any user who comes to a page that contains the web part can use it to edit the pages.
  - **Authenticated** – any authenticated user (site member) can edit the pages. You can use this value in combination with the _NodeOwner = {%CurrentUser.UserID%}_ value in the _WHERE condition_ property to display only pages created by the current user (to allow editing of these pages only for this user).
  - **Page owner** – only the owner of the parent page under which the user contribution pages are stored can edit them.

> **Note:** **Note**
>
> When rendering data that users input through user contributions (for example in [Transformations](https://docs.kentico.com/k10/developing-websites/loading-and-displaying-data-on-websites/writing-transformations.md)), be sure to properly escape or encode the values to protect against XSS attacks. See [Cross site scripting (XSS)](https://docs.kentico.com/k10/securing-websites/developing-secure-websites/cross-site-scripting-xss.md) to learn more.

> **Info:** **Security for file attachments**
>
> The system does not allow public unauthenticated users to upload file attachments.
>
> If your user contribution page types have [attachment fields](https://docs.kentico.com/k10/managing-website-content/working-with-files/page-attachments/attaching-file-groups-to-pages.md), we recommend setting the **Allow editing by users** property of your web parts to _Authenticated_, or securing the entire page to require authentication. Otherwise an error will occur if a public visitor attempts to upload a file.