Why WordPress Blocks SVG Uploads and How to Use SVG Files Safely
You export a logo as SVG, drag it into the Media Library, and WordPress refuses it:
“Sorry, this file type is not permitted for security reasons.”
Which feels wrong. SVG is a web standard, modern browsers handle it, and for a logo it’s the obvious pick. One file, sharp on every screen, often lighter than the PNG equivalent.
WordPress has a reason, though, and it’s a decent one.
An SVG isn’t a picture the way a JPEG is. It’s an XML document that the browser draws, and XML documents can hold scripts.
That’s really the whole story. Everything below is detail: why the block exists, what the risk looks like in practice, and how to turn SVG uploads on without pretending the problem isn’t there.
Why WordPress doesn’t allow SVG uploads by default
WordPress keeps a list of file types it will accept into the Media Library. JPEG, PNG, GIF, WebP, AVIF, PDF, a fair few others. SVG isn’t on that default list.
There’s a second layer as well. WordPress runs checks to confirm an upload really is what its extension claims to be, and those checks got stricter around version 4.7.1, which is why a lot of SVG workarounds from that era suddenly stopped behaving the way people expected.
Neither of those is the interesting part. The interesting part is why SVG gets treated differently from every other image format on the list, and for that you have to open one.
Why SVG files can be a security risk
Open an SVG in a text editor. You won’t find pixel data, you’ll find markup: tags and attributes, the same sort of thing you’d see in an HTML file.
That markup can include <script> elements. Event handlers like onload. <foreignObject>, which lets you drop HTML inside the graphic. References to files hosted somewhere else entirely.
None of this is a flaw. The SVG spec allows it deliberately, because the format was designed for animation and interactivity, not just static shapes.
The trouble starts once the file lives on your domain. Open an SVG directly as a document and any script inside it runs in your site’s origin, exactly as if you’d written that script yourself.
That’s stored cross-site scripting. Malicious code could execute while someone is logged in, potentially exposing information or performing actions with that person’s privileges.
It isn’t a theoretical worry either. Several plugins that added SVG upload support without cleaning the files have shipped precisely this vulnerability. WordPress core has been discussing native SVG support since 2013, and the ticket is still open more than a decade later, with sanitization still the sticking point.
Why simply enabling SVG uploads isn’t enough
Search for how to upload SVG to WordPress and you’ll land on a snippet like this:
add_filter( 'upload_mimes', function ( $mimes ) {
$mimes['svg'] = 'image/svg+xml';
$mimes['svgz'] = 'image/svg+xml';
return $mimes;
} );It does part of the job: it tells WordPress that SVG is an allowed upload type.
What it doesn’t do is look inside the file. Unsafe markup, embedded JavaScript, an external reference pointing somewhere unpleasant: the filter passes all of it straight through.
Two other suggestions come up almost as often, with the same gap.
ALLOW_UNFILTERED_UPLOADS in wp-config.php can bypass WordPress’s normal file-type restrictions for users with the appropriate capability. That’s a far broader change than “let me upload a logo.”
Plugins that only enable additional file types have the same limitation as the snippet above. Adding SVG to the allow-list and sanitizing SVG are two separate jobs, and only one of them is getting done.
Allowing takes a line of code. Sanitizing is the part that takes real work.
If you’re the only person touching your site and you created every SVG yourself, the risk is much lower. With contributors, clients, or files arriving by email from a designer you’ve never met, it becomes a much bigger concern.
How to enable SVG uploads safely in WordPress
Sanitize every file before it reaches the Media Library. Sanitization strips out the parts that can execute or load external content, and keeps the markup that actually draws the graphic.
Sanitize SVG files on upload
Our free WP SVG Images plugin handles this automatically. It enables SVG support, cleans each file at upload, refuses anything it can’t clean, and adds SVG previews in the Media Library.
The automatic part matters more than it sounds. Nobody remembers a manual cleanup step, least of all a client uploading a new logo on a Friday afternoon.
Because sanitization is security-sensitive work, keep whichever plugin you use updated. Sanitization libraries receive fixes over time, and an actively maintained plugin is worth a lot more here than one that’s been sitting untouched for four years.
Limit who can upload SVG files
Sanitization handles the file. Permissions handle the people.
Most sites don’t need every contributor uploading vectors. Narrowing it to administrators, or administrators and editors, cuts down how many accounts could introduce a problem file in the first place. WP SVG Images lets you set this per role, including which roles trigger sanitization.
Optimize SVG files before uploading
Design tools are generous exporters. Illustrator and Figma will happily hand you a file padded with metadata, comments, empty groups and leftover layers that contribute nothing to what you see on screen.
Run it through SVGO, or SVGOMG if you’d rather work in a browser, and most of that padding disappears.
This isn’t sanitization and shouldn’t be mistaken for it. Optimization makes the file smaller and tidier. Sanitization is what keeps unsafe markup off your site. Ideally, clean the SVG before uploading it, then let your SVG plugin sanitize it on the way in.
How to set up SVG uploads with WP SVG Images
- Install and activate the plugin.
- Open the settings page and pick which roles can upload SVG.
- Check that sanitization is on for every role that can upload, administrators included.
- Upload a test file and see whether it previews properly in the Media Library.
- Put it on a page and look at the front end, since an SVG loaded through an <img> tag can behave differently from SVG markup embedded directly in the page.
If the file uploads but renders at some absurd size, that’s almost always the SVG itself: a missing viewBox, or dimensions set in percentages.
One last thing on delivery. SVG is text, so it compresses well with gzip or Brotli at the server or CDN level. Serve it with the correct image/svg+xml MIME type to avoid inconsistent browser handling. It’s the same family of problem as images that convert correctly but never reach the browser.
When should you use SVG?
SVG earns its place with graphics you can describe using shapes and paths:
- logos
- icons
- simple illustrations
- diagrams
- interface elements
One file, sharp on a phone and on a 5K display, with no need for three sizes and a retina variant.
For logos and icons specifically, keep the file lean. Strip editor metadata and unused elements, make sure there’s a proper viewBox so it scales correctly, and don’t embed raster images inside the SVG unless the design genuinely needs them. A clean vector is easier to render, easier to optimize, and easier to sanitize.
Photographs are the wrong job for SVG. JPEG, WebP and AVIF exist for that, and the differences between modern photo formats are worth a look before you commit a whole site to one of them.
FAQs
Is it safe to allow SVG uploads on WordPress?
Yes, provided every file is sanitized on the way in and you’ve thought about which roles need the permission. Adding SVG to the allowed MIME types on its own inspects nothing, so that step alone isn’t enough.
Why does WordPress block SVG but allow JPEG and PNG?
JPEG and PNG don’t natively support browser-executed scripts. SVG is XML markup that can carry active content, which puts it in a different security category even though we all file it mentally under “images.”
Can I upload SVG files without a plugin?
You can, using a filter in functions.php or by enabling unfiltered uploads. Neither approach sanitizes anything, so you’d be extending trust to every file that comes through the door.
Will sanitization break my animated SVG?
Possibly. Sanitizers remove elements and attributes that could be unsafe, so some animation stops working depending on how it was built, JavaScript-driven animation especially. WP SVG Images exposes the WPSVG_setAllowedTags and WPSVG_setAllowedAttrs filters if you need a specific feature preserved, though every exception is worth thinking through before you add it.
Does SVG improve page speed?
For logos and icons, often yes. A vector icon can come in well under its PNG equivalent and stays sharp at any pixel density without extra files. For photos it does the reverse, sometimes dramatically.
Try ShortPixel on WordPress for free!
Easily optimize your pictures and generate WebP/AVIF in bulk using ShortPixel Image Optimizer.
