“Sorry, This File Type Is Not Permitted for Security Reasons” in WordPress: How to Fix It

You drag an SVG logo, a WOFF2 font, or a JSON file into the Media Library, and WordPress refuses it with one flat line: “Sorry, this file type is not permitted for security reasons.” The file isn’t broken. It isn’t too big. WordPress just doesn’t trust it.

The “sorry, this file type is not permitted for security reasons” error in WordPress is one of the few errors that is working exactly as designed. The fix is not to switch the protection off. The fix is to allow the one file type you actually need, in a way that doesn’t hand attackers a new door into your site.

What Does “Sorry, This File Type Is Not Permitted for Security Reasons” Mean?

The “Sorry, this file type is not permitted for security reasons” error means WordPress rejected an upload because its file extension, or its real MIME type, is not on WordPress’s list of allowed upload types. WordPress keeps that list deliberately short to stop executable or script-carrying files from landing on your server. Newer WordPress versions show the same block with different wording: “Sorry, you are not allowed to upload this file type.”

WordPress runs two checks on every upload. The first check looks at the file extension (.svg, .woff2, .json) and compares it to an allow-list of MIME types. The second check, added in WordPress 4.7.1, reads the actual contents of the file to confirm the real MIME type matches the extension. A file can fail either check.

That second check is why some people add a file type to the allow-list and still get the error. The extension is now allowed, but the server’s file detection reports a different MIME type than WordPress expects, so WordPress still refuses the upload.

Why WordPress Blocks Some File Types

WordPress blocks file types outside its default list because upload forms are one of the most direct ways to get malicious code onto a server. If an attacker can upload a PHP file, or an SVG with embedded JavaScript, and then load it in a browser, they can run code on your site or against your logged-in users.

File upload flaws are a real, recurring category of WordPress vulnerability, not a theoretical one. According to Patchstack’s 2025 WordPress vulnerability statistics, arbitrary file upload accounted for 2.36% of the more than 11,000 WordPress vulnerabilities disclosed that year, and 91% of all disclosed vulnerabilities were in plugins rather than WordPress core. That is the context for every fix below: the more file types you open up, the more the safety of your site depends on what you allowed and who can upload it.

Which file types does WordPress allow by default?

WordPress allows common images (JPG, PNG, GIF, WebP since 5.8, AVIF since 6.5, and HEIC since 6.7), documents (PDF, DOC/DOCX, XLS/XLSX, PPT/PPTX, ODT), audio (MP3, M4A, OGG, WAV), and video (MP4, MOV, WMV, AVI, 3GP). Anything outside that set, including SVG, font files, JSON, and most code or archive formats, is blocked for regular uploads.

File type	Allowed by default?	Risk if allowed	Safest fix
SVG	No	High: can contain JavaScript	Sanitizing plugin such as Safe SVG
WOFF / WOFF2 fonts	No	Low	upload_mimes filter, or the Font Library in WordPress 6.5+
JSON / CSV	CSV yes, JSON no	Low to medium	upload_mimes filter, admin-only
ZIP	Yes (for users who can upload)	Medium	Leave as is; use it only for trusted users
PHP, JS, EXE	No	Critical	Never allow through the Media Library

Fix 1: Allow One Specific File Type With the upload_mimes Filter

The cleanest fix for the “file type not permitted” error is to add only the file type you need to WordPress’s allow-list using the upload_mimes filter. This keeps every other protection in place and gives you a precise, reversible change that lives in code instead of a settings screen.

Put the snippet in a small must-use plugin (a PHP file inside wp-content/mu-plugins/), a code snippets plugin, or your child theme’s functions.php. A must-use plugin is the better home for it, because it keeps working if you switch themes. Here is an example that allows WOFF and WOFF2 font files for administrators only:

<?php
/**
 * Plugin Name: Allow Font Uploads
 */
add_filter( 'upload_mimes', function ( $mimes ) {
    if ( current_user_can( 'manage_options' ) ) {
        $mimes['woff']  = 'font/woff';
        $mimes['woff2'] = 'font/woff2';
    }
    return $mimes;
} );

The current_user_can( 'manage_options' ) check matters. Without it, every user role that can upload media, including authors and contributors, gets the new file type too. Scoping new file types to administrators is a simple habit that removes most of the risk.

Fix 2: Fix the MIME Type Mismatch When the Extension Is Already Allowed

If you added a file type with upload_mimes and WordPress still says the file type is not permitted, the problem is almost always a MIME type mismatch. The server’s file detection (PHP’s finfo) reported a different MIME type than the one you registered, so WordPress’s real-content check rejects the file.

Fonts, JSON, and some CSV files are the usual offenders. A WOFF2 file, for example, may be detected as application/octet-stream on one server and font/woff2 on another. The wp_check_filetype_and_ext filter lets you correct the result for one specific extension:

add_filter( 'wp_check_filetype_and_ext', function ( $data, $file, $filename, $mimes ) {
    if ( ! empty( $data['ext'] ) ) {
        return $data; // WordPress already accepted it.
    }
    $check = wp_check_filetype( $filename, $mimes );
    if ( 'woff2' === $check['ext'] ) {
        $data['ext']  = 'woff2';
        $data['type'] = 'font/woff2';
    }
    return $data;
}, 10, 4 );

Keep this filter narrow. A version that blindly trusts the extension for every file type undoes WordPress’s real-content check entirely, which is the protection that stops a PHP script renamed to image.jpg.

Fix 3: Use a Sanitizing Plugin for SVG Uploads

SVG files need a sanitizing plugin, not just an allow-list entry, because SVG is XML that can carry JavaScript. Adding svg to upload_mimes makes the error go away, but it also lets any uploaded SVG run scripts when someone opens the file URL directly.

A plugin such as Safe SVG allows SVG uploads and strips scripts and other dangerous elements from each file as it is uploaded. That combination, SVG allowed plus every SVG cleaned, is the only SVG setup worth running on a production site. If you only need one logo, another option is to inline the SVG code in your theme or a Custom HTML block and skip the Media Library entirely.

Should You Use ALLOW_UNFILTERED_UPLOADS?

For almost every site, no. Adding define( 'ALLOW_UNFILTERED_UPLOADS', true ); to wp-config.php lets administrators upload virtually any file type, including executable code, and skips the real-content MIME check. It fixes the error by removing the protection rather than making an exception.

The ALLOW_UNFILTERED_UPLOADS constant only applies to administrators (super admins on Multisite), so it is not as reckless as it sounds. The real danger is what happens if one admin account is ever compromised: the attacker can now upload a PHP file through the normal Media Library. If you use the constant for a one-off upload, add it, upload the file, and delete the line straight away.

Other Ways Around the File Type Error

Sometimes the right answer is to not use the Media Library at all. WordPress’s file type restriction applies to uploads through wp-admin, so files that are part of your site’s build belong somewhere else.

• Fonts: WordPress 6.5 and later include a Font Library in the Site Editor for block themes, and self-hosted font files can live in your theme folder. If you’re moving off Google’s servers, self-hosting Google Fonts in WordPress covers the full setup.
• Theme or plugin assets: JSON configs, scripts, and stylesheets should ship inside the theme or plugin folder, uploaded by SFTP or deployment, not through the Media Library.
• Downloads for visitors: wrap unusual file types in a ZIP, which WordPress already allows for users with upload permission.

How to Tell This Error Apart From Other Upload Errors

The “file type not permitted” error is about what the file is, not how big it is or whether the server could process it. If the message is different, the cause is different too.

• “The uploaded file exceeds the upload_max_filesize directive” is a size limit. See how to increase the WordPress max upload size.
• A bare “HTTP error” after the progress bar fills is usually image processing or server limits. See WordPress HTTP error uploading images.
• “The link you followed has expired” on a theme or plugin ZIP is a PHP limit, covered in this fix guide.

Whichever fix you use, test it on a WordPress staging site first if the site takes payments or user registrations. A wrong filter in a must-use plugin can break every upload on the site, not just the one file type you were trying to fix.

The Bottom Line

The “Sorry, this file type is not permitted for security reasons” error is WordPress doing its job. Allow the exact file type you need with upload_mimes, limit it to administrators, fix MIME mismatches for that one extension only, and use a sanitizing plugin for SVG. Skip ALLOW_UNFILTERED_UPLOADS unless it is a five-minute, one-off upload you remove right after.

If you’d rather have someone set up your WordPress site so these problems don’t come up in the first place, take a look at my recent work.

Frequently Asked Questions