Why WordPress blocks SVG uploads — and how to enable them safely

If you've ever tried to upload an SVG logo or icon to the WordPress Media Library, you've probably hit a wall: "Sorry, this file type is not permitted for security reasons." That's not a bug — WordPress blocks SVG by default on purpose, and the reason is worth understanding before you work around it.

The actual risk

Unlike a JPEG or PNG, an SVG file is XML text, and XML can contain embedded scripts. A malicious SVG can carry inline JavaScript, event handlers, or references to external resources — which means an "image upload" field can, in the wrong hands, become a way to get executable code onto your site. That's a real enough risk that WordPress core simply doesn't allow SVG uploads at all, for anyone, out of the box.

The common workaround — a plugin or snippet that just adds SVG to the allowed MIME types — removes the block but does nothing about the actual risk. It re-opens the door without checking what's walking through it.

What safe SVG support actually requires

CodePros SVG Secure Support takes a different approach: it allows SVG uploads, but validates and sanitizes every file before it's accepted, through several layers.

• Extension validation — catches disguised files like payload.php.svg, not just a simple ".svg" check.
• MIME verification — confirms the file is genuinely image/svg+xml with valid XML structure, not just an extension.
• Size and complexity limits — a default 1MB size cap and a node-count ceiling (5,000 nodes by default) to block deliberately bloated files aimed at overloading the server.
• Dimension checks — a default 10,000px maximum to catch malformed or abusive files.
• Sanitization — the file content itself is cleaned using the enshrined/svg-sanitize library, with a whitelist of allowed tags and attributes, external URL references stripped, and scanning for javascript: URIs, inline <script> tags, event handler attributes, and CSS expression() tricks.

Beyond the upload itself

The plugin also applies security headers (Content-Security-Policy, X-Content-Type-Options, X-Frame-Options) to the pages that serve SVG attachments, ships hardening config snippets for Apache and Nginx, and supports role-based control over who's allowed to upload SVGs at all — so it's not an all-or-nothing setting for the whole site. Upload activity is logged to a dedicated database table with severity levels, so you have a record if something does get flagged.

Requirements

WordPress 6.0 or later, PHP 7.4 or later, and Composer for the sanitization library dependency.