WordPress shows “Sorry, this file type is not permitted for security reasons” when the file’s extension or detected MIME type is missing from its allowed upload list. The safest fix is to allow only the specific type you need with the upload_mimes filter, placed in a child theme or site-specific plugin. Do not start by enabling every file type: ALLOW_UNFILTERED_UPLOADS removes WordPress’s checks and should be a brief, last-resort measure on a trusted site.
Antihost offers managed WordPress hosting with free migration, one-click staging and a 14-day free trial.
This guide covers the common cases—SVG, WOFF and WOFF2 fonts, JSON, AVIF and WebM—then shows how to diagnose failures caused by validation, security plugins, multisite settings or your hosting provider.
As an Amazon Associate I earn from qualifying purchases.
What the error means
WordPress maintains an allowlist that maps file extensions to MIME types. During a Media Library or block-editor upload, it checks the filename and the file content. If the extension is not listed, or if the content does not match the expected type, WordPress rejects the upload before it is attached to your site.
That is why renaming a file is not a dependable fix. WordPress can call wp_check_filetype_and_ext() to establish the file’s real type. A file named logo.svg that contains something else, a damaged font, or an incorrectly generated media file may still be refused after you add svg to the allowlist.
#1 Best Overall
Typical examples include SVG graphics, .woff and .woff2 web fonts, JSON configuration files, AVIF images and WebM video. The exact list can differ by WordPress version, user capability, multisite policy and hosting configuration, so test the type you actually need rather than copying a large unrestricted list.
Check the file before changing WordPress
- Confirm the extension. Make sure the filename ends in the type you intend to upload, such as
.svg,.woff2or.avif. Remove accidental double extensions such asfont.woff2.txt. - Open a known-good file. Try a file exported by a reputable application or downloaded from the original source. If one known-good file works and another of the same extension fails, the problem is probably the file itself.
- Check the content type. An extension is only a label. A file with the wrong internal signature, incomplete transfer or invalid structure can fail WordPress’s extension-and-MIME check.
- Test the smallest useful file. A tiny sample separates a type-policy problem from a damaged or unusually large production file. Keep the test private or delete it after diagnosis.
If every file of that type fails, continue with the configuration steps below. If only one file fails, regenerate or re-export it instead of weakening the site-wide upload policy.
Free tools Windows power users keep installed
One-click scans. No signup required.
Recommended fix: add one MIME type with upload_mimes
The upload_mimes filter changes WordPress’s allowed list while retaining type checking. Add only the extension and MIME value required by your project. The array key is the extension without a leading dot; the value is the MIME type WordPress should associate with it.
Example for fonts
<?php
function myprefix_allow_extra_mimes( $mimes ) {
$mimes['woff'] = 'font/woff';
$mimes['woff2'] = 'font/woff2';
return $mimes;
}
add_filter( 'upload_mimes', 'myprefix_allow_extra_mimes' );Replace myprefix with a unique prefix for your site. A unique function name prevents collisions with a theme or plugin that happens to define the same function. If you need only WOFF2, remove the WOFF entry instead of allowing both.
Examples for other file types
| Extension | MIME type to add | Typical use | Important caution |
|---|---|---|---|
svg |
image/svg+xml |
Vector logos, icons and illustrations | WordPress’s MIME allowlist does not sanitize SVG markup. |
woff |
font/woff |
Web Open Font Format fonts | Some installations need the additional validation filter described below. |
woff2 |
font/woff2 |
Compressed web fonts | Use a genuine WOFF2 file, not a renamed archive or text file. |
json |
application/json |
Configuration or data files | Do not upload secrets or credentials to a publicly accessible Media Library. |
avif |
image/avif |
Modern compressed images | Browser, image-editor and thumbnail support can vary independently of upload permission. |
webm |
video/webm |
Web video | A host or security layer may still reject the upload after WordPress allows it. |
These values are examples of the standard extension-to-MIME mapping. Confirm that the file was produced as that type and test on the WordPress version and server used by your site.
Where to put the code so it survives updates
Option 1: a child theme’s functions.php
Use this option when the site already has a child theme and the change belongs to the presentation layer.
Crashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minuteWindows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstall- Back up the site and, preferably, test on staging.
- Open the active child theme’s
functions.phpwith your host’s file manager, SFTP or a code editor. Do not edit the parent theme if you can avoid it; a parent-theme update can erase your change. - Add the function and
add_filter()call once. If the file already begins with<?php, do not add a second opening tag. - Save the file, clear any server or application cache, and upload a known-good file of the newly allowed type from Media > Add New.
A syntax error in functions.php can make the site unavailable. Keep a recovery route—hosting file access or a recent backup—and paste code carefully.
Option 2: a site-specific plugin
A small site plugin is usually the most durable choice because the rule remains active when you change themes. Create a directory such as wp-content/plugins/site-mime-rules, then create site-mime-rules.php containing:
<?php
/**
* Plugin Name: Site MIME Rules
*/
function myprefix_allow_extra_mimes( $mimes ) {
$mimes['woff'] = 'font/woff';
$mimes['woff2'] = 'font/woff2';
return $mimes;
}
add_filter( 'upload_mimes', 'myprefix_allow_extra_mimes' );- Upload the folder and file to
wp-content/plugins. - In the dashboard, open Plugins > Installed Plugins and activate Site MIME Rules.
- Upload the test file, then document why the type is needed so another administrator can review it later.
If you later remove the requirement, delete its array entry or deactivate the plugin. You can also explicitly block an entry supplied by another component with unset(), for example:
function myprefix_remove_type( $mimes ) {
unset( $mimes['svg'] );
return $mimes;
}
add_filter( 'upload_mimes', 'myprefix_remove_type' );When fonts still fail after the allowlist change
Fonts receive stricter scrutiny on some WordPress setups. If a genuine WOFF file is still rejected after adding font/woff, a guide-supported workaround uses the wp_check_filetype_and_ext filter to provide the expected extension and MIME value during validation.
function myprefix_fix_woff_detection( $data, $file, $filename, $mimes ) {
$extension = pathinfo( $filename, PATHINFO_EXTENSION );
if ( 'woff' === strtolower( $extension ) ) {
$data['ext'] = 'woff';
$data['type'] = 'font/woff';
}
return $data;
}
add_filter( 'wp_check_filetype_and_ext', 'myprefix_fix_woff_detection', 10, 4 );Use this only for the extension you intend to accept. It should not be used to make arbitrary files appear to be fonts. If the file was exported incorrectly, regenerate it; bypassing detection can hide a real content mismatch.
Use a plugin when administrators should not edit PHP
A MIME-management plugin can expose allowed types in the WordPress dashboard. Tools such as Enhanced Media Library or File Manager are examples of plugins that can add file types without requiring a code edit. The exact menu labels and supported extensions depend on the plugin version.
- Back up the site before installing or changing a plugin that alters uploads.
- Install from Plugins > Add New and review its permissions, update history and settings.
- Open the plugin’s MIME or media settings and add only the required extension and MIME type.
- Save, clear caches if applicable, and test with a known-good file.
- Record the setting in the site’s maintenance notes so it is not lost during a plugin replacement.
A plugin does not override every other control. Security software, Network Admin settings and the host can reject a file after the plugin has added it to WordPress’s list.
Why ALLOW_UNFILTERED_UPLOADS is a last resort
Adding this constant grants the unfiltered_upload capability and disables WordPress’s normal file-type checks. In wp-config.php, it is commonly defined before the line that says “That’s all, stop editing,” for example:
Quick wins for a faster PC:
Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Clear out junk files and repair common Windows errorsFree Scan →define( 'ALLOW_UNFILTERED_UPLOADS', true );This is fundamentally different from allowing one MIME type. It can permit executable files such as PHP or shell scripts. If an untrusted user can upload, rename or execute such a file, an attacker may gain control of the site or server. Use it only briefly on a trusted, non-multisite installation when you understand the exposure, upload the necessary file, then remove the line and retest.
Rank #4
The capability is limited by context: the documented behavior described for this constant applies when it is enabled and the site is not multisite, or when the user is a multisite super administrator. It is not a suitable way to work around a Network Admin policy.
SVG needs content sanitization, not just permission
SVG is XML and can contain active elements, scripts or event handlers. The upload_mimes filter only changes whether WordPress accepts the type; it does not inspect and sanitize every SVG element. If the site genuinely needs SVG uploads, pair the allowlist entry with a maintained SVG-sanitization plugin such as Safe SVG, restrict uploads to trusted administrators and remove unused files. If you only need to display a logo, uploading a sanitized raster alternative may be safer.
Never treat an SVG downloaded from an unknown source as safe merely because it has the right extension. Review the source, sanitize it, and avoid giving ordinary contributors permission to upload arbitrary SVG files.
Multisite and network-level settings
On WordPress Multisite, individual site code may not control the final allowlist. A network administrator can define permitted file types in Network Admin, and that policy can prevent either the upload_mimes filter or ALLOW_UNFILTERED_UPLOADS from having the effect you expect.
- Ask a network administrator to review Network Admin > Settings and the network’s upload file-type settings.
- Confirm that your account has the required capability; a site administrator is not automatically a network super administrator.
- Test on the specific site and account that will perform the upload.
Do not enable unfiltered uploads across a network to solve a requirement for one site. Add the narrowest network-approved type, or keep the file outside the Media Library if the network policy intentionally prohibits it.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.When another security layer is blocking the file
If the filter is correctly loaded but the same error remains, inspect controls outside WordPress core.
Security plugins
Security plugins such as Wordfence, iThemes Security and All In One WP Security can enforce upload restrictions after core accepts a MIME type. Temporarily review their upload, firewall and malware-scanning settings on a staging copy. Change one setting at a time, test, and restore the strongest safe policy that still meets the requirement.
Hosting restrictions
Hosts can block extensions, MIME types or executable content at the web-server, malware-scanner or account-policy level. A reported WebM case continued to fail even after both a MIME filter and the unfiltered-upload constant were configured, leading to a suspected host restriction. If that happens, give the host the exact extension, MIME type, timestamp and WordPress error, and ask whether server policy is rejecting it.
Wrong site or stale code
- Verify that the code is in the active child theme or an activated plugin on the site where you are uploading.
- Check for a PHP syntax error or a fatal-error log entry.
- Confirm that a caching or deployment system has published the changed file.
- Make sure another plugin is not removing the MIME entry later in the request.
A practical troubleshooting sequence
- Upload a known-good file of the same extension.
- Read the extension and MIME entry in your code; do not include the leading dot in the array key.
- Check whether the file’s actual content matches that MIME type.
- Test the narrow
upload_mimesrule in a child theme or site plugin. - If it is a font, apply the targeted validation workaround only after confirming the file is genuine.
- Review security-plugin settings and temporarily test on staging.
- For multisite, ask the network administrator to verify the network allowlist.
- Ask the host whether server-side policy is blocking the extension.
- Remove any temporary bypass, especially
ALLOW_UNFILTERED_UPLOADS, and retest with the final least-privileged configuration.
Choosing the right approach
| Approach | Scope | Survives a theme update? | Code required | Security exposure |
|---|---|---|---|---|
upload_mimes in a child theme |
Specific types for the site | Yes, while the child theme remains active | A few PHP lines | Low when limited to trusted types |
upload_mimes in a site plugin |
Specific types for the site | Yes, independent of the theme | A small plugin file | Low when limited to trusted types |
| MIME-management plugin | Specific types through an admin interface | Usually, while the plugin remains active | None | Depends on plugin quality and settings |
ALLOW_UNFILTERED_UPLOADS |
All file types | Until removed from configuration | One configuration line | High; executable uploads may be accepted |
For almost every normal requirement, the child-theme or site-plugin filter is the appropriate balance. A dashboard plugin is reasonable when the people maintaining the site should not edit PHP. Unfiltered uploads are an emergency exception, not a permanent configuration.
After the upload succeeds
Permission to upload does not guarantee that the browser can display or process the file. A browser may lack AVIF or WebM support, a page builder may reject a font, and WordPress may not generate thumbnails for a newly supported image format. Verify the file’s URL, inspect the attachment metadata and test it in the feature that needs it.
For fonts, reference the correct file in your CSS and keep licensing records. For JSON, protect private configuration from public indexing and never store passwords, API keys or personal data in a Media Library attachment. For SVG, retain the sanitized source and restrict who can replace it.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Quick Recap
Common mistakes to avoid
- Editing the parent theme: an update can remove the rule.
- Allowing every extension: this expands the attack surface without solving a single-type requirement.
- Trusting a renamed file: WordPress checks content as well as the filename.
- Using unfiltered uploads permanently: executable uploads can become a server-compromise path.
- Forgetting multisite policy: Network Admin can override site-level expectations.
- Ignoring security plugins and the host: WordPress core is only one enforcement layer.
- Allowing unsanitized SVG: the MIME filter does not remove scripts or dangerous markup.
- Skipping a known-good test: a corrupt file can look like a policy failure.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
