ProjectSend

Last reviewed Sep 13, 2026 · 735 words

ProjectSend solves one problem: sending deliverables to clients in a way that is private per client, logged, branded, and does not depend on a WeTransfer link expiring or a Dropbox folder somebody shared with the wrong person. A photographer with 30 wedding clients, a small agency handing over design files, an accountant returning signed documents; that is who runs it. If you want folders synced to laptops, this is the wrong tool and the catalogue's "file-sync" placement is the only misleading thing about it.

The model: clients, groups, files, and who sees what

You are the administrator. Each customer gets a client account, clients can be grouped, and every uploaded file is assigned to specific clients or groups. A client logs in and sees only their files, with download counts and dates visible to you. Files can carry expiry dates and download limits, public links can be generated for the odd case where a login is too much friction, and clients can be allowed to upload back to you, which turns the portal into a two-way exchange for source material. Email notifications fire on upload, on account creation, and on file assignment, using templates you can edit.

Branding is real rather than a logo swap: your logo, colours, a custom title, and footer text, so the client sees your studio rather than a piece of open-source software. That detail is why it competes with paid client portals more than with file-sharing tools.

The compose that works

services:
  projectsend:
    image: lscr.io/linuxserver/projectsend:latest
    environment:
      - PUID=1000
      - PGID=1000
      - TZ=Europe/London
      - MAX_UPLOAD=5000
    volumes:
      - ./config:/config
      - /srv/projectsend:/data
    ports:
      - "8085:80"
    depends_on:
      - db
    restart: unless-stopped
  db:
    image: mariadb:11
    environment:
      - MYSQL_ROOT_PASSWORD=change-me
      - MYSQL_DATABASE=projectsend
      - MYSQL_USER=projectsend
      - MYSQL_PASSWORD=change-me
    volumes:
      - ./mysql:/var/lib/mysql
    restart: unless-stopped

MAX_UPLOAD is in megabytes and sets the PHP limits inside the container; the default is too small for video delivery. The first visit runs an installer that writes the database settings and creates the admin. Uploaded files land under /data, and that directory plus a nightly mysqldump is the complete backup. Put a reverse proxy with TLS in front and set its body size limit to match MAX_UPLOAD, or large uploads will fail at the proxy with an error that looks like a ProjectSend bug.

The PHP realities

ProjectSend is a classic PHP application from 2012 that has been kept alive rather than rewritten, and the interface shows it. That is not a criticism of the operator experience, which is simple: no queue workers, no cache, no search index, one database. It is a security note. Keep the image updated, because a public-facing login form and an upload handler are exactly the two things attackers probe, and put the whole thing behind rate limiting at the proxy. The upload directory is served by the app, not directly by the web server, so files are not guessable by URL, but confirm after install that https://your-host/upload/ returns a 403 and not a listing.

Client uploads, if you enable them, should be paired with the file-type restrictions in settings; a portal that accepts any extension from any client is a liability.

Where Nextcloud or a share tool is enough

Nextcloud share links with a password and expiry cover the one-off delivery case, and if your clients already need a shared folder that syncs, it is the answer to both problems. Pingvin Share and picoshare cover "send this file, link expires in a week" with far less machinery. ProjectSend wins when the relationship is ongoing: a client who will receive 12 deliveries over a year, wants to find last March's files without asking you, and expects the portal to carry your name. The WeTransfer alternatives page lays out the send-once tools if that is closer to your need.

What I'd do

If clients are recurring and the files are your product, run ProjectSend from the linuxserver image with MariaDB, brand it in the first hour, set expiry defaults so old deliveries clean themselves up, and review the client list quarterly to disable accounts that have finished. If deliveries are occasional, skip it and use Nextcloud share links; the portal is worth running only when the client experience is part of what you are selling.