That totally misses the point though, because if the website only validates on the basis of extension and accepts the format in an unrecognised format, the backend won’t know how to handle it anyway. There’s no point uploading a HEIC file disguised as a PNG (or whatever) if eventually somewhere along the workflow an examiner is actually going to have to open that file in a program that doesn’t know how to parse HEICs.