Why WordPress blocks SVG uploads (and how to enable them safely)

If you've ever tried to upload an SVG logo or icon to the WordPress Media Library, you've probably hit a wall: "Sorry, this file type is not permitted for security reasons." That's not a bug. WordPress blocks SVG by default on purpose, and the reason is worth understanding before you work around it.

The actual risk

Unlike a JPEG or PNG, an SVG file is XML text, and XML can contain embedded scripts. A malicious SVG can carry inline JavaScript, event handlers, or references to external resources, which means an "image upload" field can, in the wrong hands, become a way to get executable code onto your site. That's a real enough risk that WordPress core simply doesn't allow SVG uploads at all, for anyone, out of the box.

The common workaround (a plugin or snippet that just adds SVG to the allowed MIME types) removes the block but does nothing about the actual risk. It re-opens the door without checking what's walking through it.

What safe SVG support actually requires

CodePros SVG Secure Support takes a different approach: it allows SVG uploads, but validates and sanitizes every file before it's accepted, through several layers.

• Extension validation: catches disguised files like payload.php.svg, not just a simple ".svg" check.
• MIME verification: confirms the file is genuinely image/svg+xml with valid XML structure, not just an extension.
• Size and complexity limits: a default 1MB size cap and a node-count ceiling (5,000 nodes by default) to block deliberately bloated files aimed at overloading the server.
• Dimension checks: a default 10,000px maximum to catch malformed or abusive files.
• Sanitization: the file content itself is cleaned using the enshrined/svg-sanitize library, with a whitelist of allowed tags and attributes, external URL references stripped, and scanning for javascript: URIs, inline <script> tags, event handler attributes, and CSS expression() tricks.

Beyond the upload itself

The plugin also applies security headers (Content-Security-Policy, X-Content-Type-Options, X-Frame-Options) to the pages that serve SVG attachments, ships hardening config snippets for Apache and Nginx, and supports role-based control over who's allowed to upload SVGs at all, so it's not an all-or-nothing setting for the whole site. Upload activity is logged to a dedicated database table with severity levels, so you have a record if something does get flagged.

Requirements

WordPress 6.0 or later, PHP 7.4 or later, and Composer for the sanitization library dependency.