The WordPress message “Sorry, this file type is not permitted for security reasons” means the upload does not match a file extension and MIME type in WordPress’s allowed list. The safest fix is to allow only the specific type you need with the upload_mimes filter in a child theme or site-specific plugin, then test the upload. Do not begin by enabling every file type: ALLOW_UNFILTERED_UPLOADS disables the protection and should be a temporary last resort.
Antihost offers managed WordPress hosting with free migration, one-click staging and a 14-day free trial.
This guide covers SVG, WOFF and WOFF2 fonts, JSON, AVIF, WebM and other rejected formats; explains why an apparently correct extension can still fail; and gives recovery steps when a security plugin, multisite policy or hosting restriction is responsible.
As an Amazon Associate I earn from qualifying purchases.
Do these 3 things before closing this tab:
1Clear out junk files and repair common Windows errors2Fix the driver behind crashes, sound loss and screen glitches3Repair Windows errors before they cause bigger problemsWhat the “file type not permitted” error means
WordPress maintains an allowlist that maps extensions such as svg or woff2 to MIME types such as image/svg+xml or font/woff2. During an upload, WordPress checks the filename extension and the detected content type. If either value is not accepted, the Media Library rejects the file before it is attached to a post.
That is why changing logo.txt to logo.svg is not a reliable fix. WordPress can inspect the file and compare its real content with the claimed extension through wp_check_filetype_and_ext(). A file with a mismatched, malformed or incorrectly declared type can therefore fail even after its extension has been added to the allowlist.
#1 Best Overall
Formats commonly rejected
- SVG images, especially on sites that do not sanitize uploaded XML.
- WOFF and WOFF2 web-font files.
- JSON configuration or data files.
- Newer image formats such as AVIF, depending on the site’s WordPress and server configuration.
- Video or audio formats that are not in the site’s current MIME map, including some WebM variants.
The message does not identify whether the extension, MIME check, security plugin or host caused the rejection. Treat it as a diagnosis to investigate rather than proof that the file itself is corrupt.
Check the file and site before changing anything
Run these checks first. They prevent a risky configuration change when the real problem is a bad download, a typo in the filename or an external security rule.
Recommended Free Tools
- Use a known-good copy. Obtain the file again from its original source and save it locally. Do not test an executable or an untrusted archive merely to make the error disappear.
- Inspect the extension. Turn on filename extensions in your operating system and confirm that the file is really, for example,
icon.svg, noticon.svg.txt. - Identify the intended MIME type. Use the format’s specification or the application that created it. An extension can have more than one possible MIME declaration, so use the value expected by the software that will consume the file.
- Test a different file of the same type. A second, known-good SVG, font or video separates a file-specific problem from a site-wide rule.
- Back up the site. Save the active theme or plugin files and, if possible, take a database and filesystem backup before editing PHP.
- Confirm administrator access. The Media Library, plugin settings and Network Admin controls are different on a multisite installation. An editor-level account may not be able to change any of them.
If an ordinary JPEG or PNG uploads but the target format does not, the allowlist is the likely starting point. If every upload fails, investigate permissions, disk space, PHP limits and security software instead of adding MIME types.
Recommended fix: allow one MIME type with upload_mimes
The upload_mimes filter changes WordPress’s allowed MIME map without turning off all validation. Add only the extensions the site genuinely needs. Put the code in a child theme’s functions.php or, preferably, a small site-specific plugin so a parent-theme update cannot remove it.
Example for fonts
<?php
function vgs_allow_extra_mimes( $mimes ) {
$mimes['woff'] = 'font/woff';
$mimes['woff2'] = 'font/woff2';
return $mimes;
}
add_filter( 'upload_mimes', 'vgs_allow_extra_mimes' );Each array key is the lowercase extension without a dot; each value is the MIME type WordPress should accept. The function name is arbitrary but must be unique on your site. Add the pair for the format you need rather than copying a large list from an unrelated tutorial.
Examples for other formats
<?php
function vgs_allow_selected_mimes( $mimes ) {
$mimes['svg'] = 'image/svg+xml';
$mimes['json'] = 'application/json';
$mimes['avif'] = 'image/avif';
$mimes['webm'] = 'video/webm';
return $mimes;
}
add_filter( 'upload_mimes', 'vgs_allow_selected_mimes' );Use only the entries required by the site. For a font-only requirement, do not add SVG, JSON, AVIF and WebM as a bundle. A narrower rule reduces the number of file types that an account with upload access can place on the server.
Install the code as a site-specific plugin
- Create a file such as
vgs-extra-mimes.phpon your computer. - Place the PHP opening tag and the function in the file. Add a plugin header if your WordPress installation requires one to recognize it in the Plugins screen.
- Upload the file to the site-specific plugins directory used by your installation, or create it through the host’s file manager.
- In the WordPress dashboard, open Plugins, locate the file and activate it.
- Open Media > Add New and upload a small, known-good file of the permitted type.
If you instead use a child theme, open Appearance > Theme File Editor only when your host permits that editor and you have a backup. Select the child theme, edit its functions.php, paste the function once, save, and test. Never put the change in the parent theme when you need it to survive updates.
Removing a type
The same filter can remove an entry that should no longer be accepted:
function vgs_remove_unwanted_mime( $mimes ) {
unset( $mimes['svg'] );
return $mimes;
}
add_filter( 'upload_mimes', 'vgs_remove_unwanted_mime' );Removing an allowlist entry does not delete files already stored in the Media Library. Review existing files separately if a type was allowed accidentally.
When a font still fails after the extension is allowed
Some font uploads pass the extension map but fail the deeper file check. WordPress uses wp_check_filetype_and_ext() to compare the declared extension with the file’s real content. A WOFF file generated incorrectly, served with the wrong internal signature or renamed from another format can be rejected for that reason.
A font-specific validation filter can provide the expected extension and MIME type after you have confirmed that the file is a genuine WOFF or WOFF2 file. Because the filter’s accepted arguments and validation behavior can change between WordPress releases, verify the current hook signature and test on a staging copy before deploying. The essential pattern is:
function vgs_fix_font_file_check( $data, $file, $filename, $mimes, $real_mime ) {
$extension = strtolower( pathinfo( $filename, PATHINFO_EXTENSION ) );
if ( 'woff' === $extension ) {
$data['ext'] = 'woff';
$data['type'] = 'font/woff';
} elseif ( 'woff2' === $extension ) {
$data['ext'] = 'woff2';
$data['type'] = 'font/woff2';
}
return $data;
}
add_filter( 'wp_check_filetype_and_ext', 'vgs_fix_font_file_check', 10, 5 );This pattern does not repair a damaged font or convert one format into another. If the same file fails in a clean test site, regenerate or re-download it. If it works elsewhere, remove the extra filter and inspect other site-level restrictions before adding more exceptions.
No-code option: an allowlist plugin
A MIME-management plugin can expose the allowed types in the dashboard instead of requiring PHP. This is useful when several administrators maintain the site or when a deployment process does not permit theme edits. The exact menu name depends on the plugin and WordPress version, but the workflow is generally:
- Install a maintained MIME-management plugin from Plugins > Add New.
- Open its settings and choose the option to add a file type.
- Enter the extension without a leading dot and the exact MIME type.
- Save, upload a known-good test file, and confirm that the attachment appears in the Media Library.
- Document the entry so it can be removed when the project no longer needs that format.
A plugin is not automatically safer than a few lines of code. Review its update history, limit access to its settings, and keep the list narrow. Do not install several plugins that all modify MIME handling; their rules can conflict and make troubleshooting harder.
The Tool Desk
Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →ALLOW_UNFILTERED_UPLOADS: a temporary last resort
Defining ALLOW_UNFILTERED_UPLOADS as true grants the capability associated with unfiltered uploads and disables WordPress’s normal file-type checks. In a single-site installation, the setting can be used by an authorized account. On multisite, the capability is limited to a super administrator and the constant may not override a Network Admin file-type policy.
If you must use it briefly on a trusted, isolated site, add the definition in wp-config.php before the line that says WordPress stops editing the file:
define( 'ALLOW_UNFILTERED_UPLOADS', true );- Back up the site and restrict dashboard access to the smallest possible group.
- Add the definition in the correct configuration file and save it.
- Upload only the required file, preferably during a short maintenance window.
- Remove the definition immediately after the upload and verify that the site still loads.
- Review the Media Library and server logs for unexpected files.
This setting permits any file type, including executable files such as PHP or shell scripts. If an attacker can upload and execute one of those files, the server or the entire account may be compromised. It is therefore not a normal production fix, and it should never be left enabled merely because a particular extension is inconvenient.
Multisite and Network Admin restrictions
Multisite has an additional allowlist controlled from Network Admin. A per-site upload_mimes filter or the unfiltered-upload constant may appear to work in a standalone test but have no effect when the network’s permitted file types are enforced.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Ask a network administrator to review the network’s upload settings and add the extension there if policy allows it. Test from the affected site with the same account that receives the error. A super administrator may be able to upload a type that a normal site administrator cannot, so do not treat a successful super-admin test as proof that every user has permission.
Security plugins and host-level blocks
WordPress core is only one layer of upload security. Security plugins can apply their own extension, filename or content rules after the core allowlist accepts a file. Check the security plugin’s media, firewall and file-upload settings, and inspect its activity log for a blocked request. Change one rule at a time, test, and restore the restrictive setting when possible.
Hosts can also reject uploads at the web-server, malware-scanning or account-policy layer. This is common when a format is considered executable, unusually large or unsupported by the server’s MIME database. If the same known-good file fails after you have confirmed the core filter, plugin settings and multisite policy, ask the host whether the extension or MIME type is blocked and request the precise reason from its logs. Do not keep adding PHP filters when the request never reaches WordPress.
Rank #4
SVG and font uploads need extra care
SVG
SVG is XML, not just a bitmap image. It can contain scripts, external references or unexpected elements. Adding image/svg+xml with upload_mimes only changes the allowlist; it does not inspect or sanitize the file contents.
Free tools Windows power users keep installed
One-click scans. No signup required.
- Allow SVG only for users who need it.
- Sanitize every uploaded SVG with a maintained SVG-sanitization tool before it is displayed.
- Prefer a trusted, locally generated SVG over a file downloaded from an unknown source.
- If the site only needs a logo or icon and cannot enforce sanitization, keep SVG blocked and use a raster format instead.
WOFF and WOFF2
Fonts are generally less risky than executable scripts, but they still deserve a narrow rule. Accept only font/woff and font/woff2, use files from a trusted source, and store them where the site’s content-security and cross-origin policies expect them. A font that is actually a ZIP archive, a mislabeled OpenType file or a truncated download should be replaced rather than forced through validation.
Which fix should you choose?
| Approach | Scope | Survives parent-theme updates | Security exposure | Code required | Best use |
|---|---|---|---|---|---|
upload_mimes in a child theme |
Specific extensions, site-wide | Yes, while the child theme remains active | Low when limited to required MIME types | A few PHP lines | A site already using a child theme |
upload_mimes in a site plugin |
Specific extensions, site-wide | Yes, independent of the theme | Low when limited to required MIME types | A few PHP lines | The most portable code-based solution |
| MIME-management plugin | Specific extensions, site-wide | Yes, through the plugin setting | Depends on the plugin and its configuration | None | Teams that need dashboard controls |
| Font validation filter | Specific font checks | Yes, when stored in a plugin or child theme | Moderate; it changes deeper validation | Several PHP lines | A genuine WOFF/WOFF2 file rejected after allowlisting |
ALLOW_UNFILTERED_UPLOADS |
All file types | Until removed | High, including executable uploads | One configuration line | Short, controlled emergency testing only |
Troubleshoot the error by symptom
The filter was added but the same message appears
- Confirm the code is active: the child theme is active or the site plugin is activated.
- Check spelling, capitalization and the MIME value. The extension must not include a dot.
- Remove duplicate functions or syntax errors that prevent the file from loading.
- Clear any page, object or security-plugin cache, then sign out and back in.
- Try a small known-good file of the same format.
- Review security-plugin logs and ask the host whether the request is blocked upstream.
The extension is accepted but the upload says the file is invalid
This usually points to content validation rather than the allowlist. Confirm the file’s internal format, regenerate it with the application that created it, and inspect the result with a file-identification utility. For fonts, use the dedicated validation pattern only after confirming the file is genuinely WOFF or WOFF2.
Only one user receives the error
Compare capabilities, role restrictions and security-plugin policies for that account. A network administrator or super administrator may have upload rights that a contributor or site administrator lacks. Test with the affected user rather than relying on an administrator’s successful upload.
Uploads work in Media Library but fail in the block editor
The editor may use a different request path or a plugin may filter REST API uploads separately. Check the browser’s network response, security-plugin activity and the user’s capability. Confirm the file appears in the Media Library first; if it does, the MIME allowlist is probably no longer the failing layer.
Windows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallCrashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minuteThe change broke the site with a PHP error
Use the host’s file manager or a secure file transfer method to remove the newly added function, then restore the backup. A syntax error in functions.php can make the front end and dashboard unavailable. Once the site is back, move the rule into a small plugin and test it on staging before reactivating it.
The file uploads but cannot be viewed or used
Allowing an upload does not guarantee browser support, correct server headers, font permissions or application compatibility. Check that the server serves the MIME type expected by the consumer and that the file’s URL is reachable. For SVG, verify that sanitization did not remove required elements; for fonts, check the CSS URL and cross-origin policy.
Safe operating checklist
- Allow only the extension and MIME type that the project requires.
- Store custom rules in a child theme or site-specific plugin, not a parent theme.
- Sanitize SVG files before displaying them.
- Use a genuine, known-good file for every test.
- Keep security-plugin and host restrictions enabled unless there is a documented reason to change them.
- Remove temporary
ALLOW_UNFILTERED_UPLOADSimmediately after use. - Document who needs the format, why it is needed and how to remove the rule later.
Frequently asked questions
Will renaming a file extension fix the error?
No. WordPress checks the detected content as well as the filename. Renaming a file can make the extension look correct while leaving the underlying format unchanged, which can trigger a different validation failure.
Can I allow an executable extension with upload_mimes?
The filter can add entries to the MIME map, but allowing executable content creates a serious security risk and may still be blocked by the web server or a security plugin. Do not use it as a way to deploy application code through the Media Library.
Why does an SVG still fail after I add image/svg+xml?
An SVG can be rejected by a sanitization or security rule, by multisite Network Admin settings or by the host. It may also be malformed. Check those layers and use a sanitization tool; the MIME filter alone does not inspect SVG contents.
How can I find the MIME type of a file?
Check the format’s technical documentation and compare it with the value reported by a trusted file-identification utility. Do not rely solely on a browser’s download label, because that label can reflect a server header rather than the file’s actual contents.
Does the rule apply to files already in the Media Library?
The rule affects future upload validation. It does not automatically change, rescan or delete files that were uploaded earlier. Review existing attachments separately if your security policy has changed.
Is a plugin safer than editing PHP?
Neither approach is inherently safer. A narrowly scoped rule in a maintained site plugin or child theme has the same basic security boundary. A plugin is preferable when administrators need a dashboard control, while code is preferable when you need a small, version-controlled rule and can test it safely.
Quick wins for a faster PC:
Repair Windows errors before they cause bigger problemsFix Now →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Frequently Asked Questions
Can I allow an executable extension with the upload_mimes filter?
Although the filter can alter the MIME map, allowing executable content can expose the server and may be blocked by other layers. Do not use the Media Library to deploy application code.
Why does an SVG still fail after I add image/svg+xml?
Security or sanitization rules, multisite settings, host policies or malformed SVG content can still reject it. The MIME filter does not inspect SVG contents.
Does the rule change files already in the Media Library?
No. It affects future upload validation; existing attachments must be reviewed separately.
The Bottom Line
Allow the one file type you need with upload_mimes in a child theme or site-specific plugin, test a known-good file, and investigate security plugins, multisite policy and host restrictions if it still fails. Keep ALLOW_UNFILTERED_UPLOADS disabled except for a brief, controlled emergency test.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
