Recommended Free Tools
iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
Antihost offers managed WordPress hosting with free migration, one-click staging and a 14-day free trial.
WordPress shows “Sorry, this file type is not permitted for security reasons” when the uploaded file’s extension or detected MIME type is not in WordPress’s allowed list. The safest fix is to allow only the specific type you need with the upload_mimes filter in a site-specific plugin or child theme, then test the upload. Do not start by enabling every file type: ALLOW_UNFILTERED_UPLOADS removes the normal checks and should be a short-term last resort.
This guide explains how the check works, how to allow fonts, SVG, JSON, AVIF and other formats, why an upload can still fail after you add a MIME type, and how to handle multisite, security-plugin and hosting restrictions.
The Tool Desk
Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →What the WordPress error means
Every upload is checked against a list of permitted extensions and MIME types. The extension is the suffix in the filename, such as woff2, svg or avif. The MIME type describes the content, such as font/woff2, image/svg+xml or image/avif. If either value is not allowed, WordPress rejects the file before it is added to the Media Library.
The message is therefore a security-policy error, not proof that the file is damaged. It commonly appears with:
#1 Best Overall
- Read Before You Buy — No Video Output: These adapters support charging and USB 2.0 data transfer, but cannot transmit video signals. Except for standard USB webcams (which use USB data only), they are not compatible with HDMI/DisplayPort cables, video-capable USB-C hubs, or docking stations with video output.
- Convert USB-A Ports to USB-C: Designed to connect USB-C earphones, cables, flash drives, card readers, and other USB-C accessories to standard USB-A ports. Plug-and-play with no drivers or software required.
- Aluminum Alloy Housing: Built with a sturdy aluminum alloy shell that aids in heat dissipation and protects against daily wear and scratches. Designed to maintain a stable and secure connection.
- Compact & Travel-Friendly: The ultra-compact design allows the adapter to stay plugged into your device without blocking adjacent ports or adding bulk, reducing wear and tear on your original USB ports.
- 12-Month Warranty: Backed by a 12-month manufacturer warranty for peace of mind. Designed to meet strict quality control standards for reliable everyday performance.
- SVG graphics, because SVG is XML that can contain active content.
.woffand.woff2web fonts.- JSON configuration or data files.
- Newer image formats such as AVIF.
- Video formats such as WebM when a host or security layer has an additional restriction.
WordPress also checks what the file really contains. Its wp_check_filetype_and_ext() process can compare the filename, the declared MIME type and the detected content. Renaming a disallowed file, or changing only its extension, does not reliably bypass the check; a mismatch can still cause rejection.
Identify the exact type before changing WordPress
Allowing a broad category such as “all images” creates more risk and makes future troubleshooting harder. First record the exact extension and MIME type that the file should use.
- In your operating system, enable filename extensions and note the suffix, for example
woff2rather than just “font.” - Confirm the file came from a trusted source and opens in an appropriate application.
- Try uploading a known-good file of the same type through Media > Add New. A working sample distinguishes a bad file from a site-wide policy problem.
- Check the filename for extra suffixes such as
.svg.txt, spaces, or characters added by an email or download service. - Keep a backup of the site and, especially,
wp-config.phpbefore changing PHP or configuration files.
If the known-good sample works, repair or replace the original file instead of weakening the site’s upload policy.
Choose the least-permissive fix
These approaches differ in scope and risk. Use the first option that solves the specific upload.
| Method | Scope | Code required | Security exposure | Survives a parent-theme update? |
|---|---|---|---|---|
upload_mimes filter |
Only the extensions you list | A few PHP lines | Low when limited to trusted types | Yes, when placed in a child theme or site plugin |
| Additional validation filter | A narrowly identified validation exception, often a font | PHP code and testing | Low to moderate; depends on the condition | Yes, in a child theme or site plugin |
| MIME-management plugin | Types selected in its settings | None | Depends on the plugin and selected types | Plugin settings remain when the theme changes |
ALLOW_UNFILTERED_UPLOADS |
All file types for eligible users | A configuration constant | High; executable files can be uploaded | Until you remove the constant |
Recommended fix: add one MIME type with upload_mimes
The upload_mimes filter changes the allowed list without turning off WordPress’s entire upload policy. Put the code in a small site-specific plugin or your active child theme’s functions.php. Do not put it in a parent theme that will be replaced by an update.
Use a site-specific plugin
- Open
wp-content/plugins/with your host’s file manager or SFTP. - Create a folder such as
my-site-upload-types. - Inside it, create
my-site-upload-types.php. - Add a plugin header and the filter shown below, replacing the entries with only the formats you require.
- Save the file, then go to Plugins > Installed Plugins in WordPress and activate it.
<?php
/**
* Plugin Name: Site upload types
*/
function myprefix_allow_extra_mimes( $mimes ) {
$mimes['woff'] = 'font/woff';
$mimes['woff2'] = 'font/woff2';
return $mimes;
}
add_filter( 'upload_mimes', 'myprefix_allow_extra_mimes' );Each array key is the lowercase extension without a dot. Each value is the MIME type. The example allows only WOFF and WOFF2 fonts. If you need one format, remove the other line rather than keeping an unused permission.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Rank #2
- 5-in-1 USB-C Hub: Experience comprehensive connectivity featuring a Power Delivery input, two USB-A 2.0 ports, a USB-A 3.0 port, and an HDMI port. (Note: The USB-C power delivery input port is only for connecting an external wall charger to power your laptop and cannot power peripheral devices.)
- 90W Pass-Through Charging: Achieve optimal charging with 90W pass-through power to your laptop, supported by a total input of 100W, with the hub reserving 10W for operational efficiency. (Note: Wall charger not included.)
- Quick Data Transfers: Accelerate your productivity with rapid data transfers using a high-speed 5Gbps USB 3.0 port and two 480Mbps USB 2.0 ports.
- 4K HDMI Display: Enhance your visual experience with a hub capable of delivering 4K resolution at 30Hz in both mirror and extend modes. Please note that this hub is compatible with MacBook (macOS 12 and newer), Windows 10 and 11, ChromeOS, and laptops equipped with DP Alt Mode and Power Delivery. Note: This device is not compatible with Linux.
- What You Get: Anker USB-C Hub (5-in-1, 4K HDMI), welcome guide, 18-month warranty, and our friendly customer service.
Use a child theme instead
Open wp-content/themes/your-child-theme/functions.php and add the function and add_filter() call. If the file begins with <?php, do not add a second opening tag. A child theme keeps the change separate from the parent theme, so a parent-theme update does not erase it. A site plugin is usually preferable when the permission should remain active after changing themes.
Common MIME mappings
| Extension | MIME value | Typical reason |
|---|---|---|
svg |
image/svg+xml |
Vector logo or illustration |
woff |
font/woff |
Web font |
woff2 |
font/woff2 |
Compressed web font |
json |
application/json |
Configuration or data file |
avif |
image/avif |
AVIF image |
webm |
video/webm |
WebM video |
These values identify the intended content; they do not convert a file. If the file’s actual bytes do not match the claimed type, later validation can still reject it.
When an allowed font still fails validation
Fonts are a frequent exception. Some servers or PHP file-information libraries report a different MIME value for WOFF files, so adding the extension to upload_mimes may not be enough. A narrowly scoped wp_check_filetype_and_ext filter is one pattern used to tell WordPress the expected extension and type for a known font extension.
function myprefix_fix_woff_validation( $data, $file, $filename, $mimes, $real_mime ) {
$extension = strtolower( pathinfo( $filename, PATHINFO_EXTENSION ) );
if ( 'woff' === $extension ) {
$data['ext'] = 'woff';
$data['type'] = 'font/woff';
}
if ( 'woff2' === $extension ) {
$data['ext'] = 'woff2';
$data['type'] = 'font/woff2';
}
return $data;
}
add_filter( 'wp_check_filetype_and_ext', 'myprefix_fix_woff_validation', 10, 5 );Use this only for the extensions you control, and test it on a staging copy first. It changes validation results; it does not sanitize a font or prove that an untrusted file is safe. If the same file fails after this narrow exception, investigate the security plugin and host rather than adding more MIME entries.
Use a plugin when you do not want to edit PHP
A MIME-management plugin can expose an administration screen for adding allowed extensions. This is useful when you maintain a site for someone who should not edit theme or plugin files.
- Back up the site, then install a maintained plugin that specifically manages allowed upload MIME types.
- Open the plugin’s settings page; the location varies, so use the plugin’s documented menu rather than guessing a URL.
- Add the exact extension and MIME value, such as
jsonwithapplication/json. - Save, clear any page or object cache if the plugin requests it, and test from Media > Add New.
- Remove types that are no longer needed and review the setting after plugin updates.
A plugin does not automatically make a risky format safe. For SVG, choose a tool that sanitizes SVG content, or leave SVG disabled when users do not need it. For any plugin, check its maintenance status, permissions and whether it changes only the MIME list or also bypasses content checks.
Rank #3
- Sleek 7-in-1 USB-C Hub: Features an HDMI port, two USB-A 3.0 ports, and a USB-C data port, each providing 5Gbps transfer speeds. It also includes a USB-C PD input port for charging up to 100W and dual SD and TF card slots, all in a compact design.
- Flawless 4K@60Hz Video with HDMI: Delivers exceptional clarity and smoothness with its 4K@60Hz HDMI port, making it ideal for high-definition presentations and entertainment. (Note: Only the HDMI port supports video projection; the USB-C port is for data transfer only.)
- Double Up on Efficiency: The two USB-A 3.0 ports and a USB-C port support a fast 5Gbps data rate, significantly boosting your transfer speeds and improving productivity.
- Fast and Reliable 85W Charging: Offers high-capacity, speedy charging for laptops up to 85W, so you spend less time tethered to an outlet and more time being productive.
- What You Get: Anker USB-C Hub (7-in-1), welcome guide, 18-month warranty, and our friendly customer service.
SVG requires sanitization, not just permission
An SVG is an XML document and can contain elements or attributes that are unsafe when rendered in a browser. The upload_mimes filter only adds image/svg+xml to the allowed list; it does not inspect and clean the document.
If SVG uploads are necessary:
- Restrict the capability to trusted administrators or a tightly controlled role.
- Sanitize every SVG with a maintained SVG-sanitization plugin or an equivalent trusted process before it is served.
- Strip scripts, event handlers, external references and other active content.
- Keep unsanitized SVG files out of public uploads and never accept them from anonymous visitors.
- Test both the upload and the rendered image after sanitization; a file that uploads is not necessarily safe to display.
If the site only needs logos supplied by developers, converting them to a raster image or having an administrator place sanitized files in the theme may be safer than opening SVG uploads to ordinary editors.
Crashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minutePC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11Why ALLOW_UNFILTERED_UPLOADS is a dangerous last resort
Defining ALLOW_UNFILTERED_UPLOADS as true grants the unfiltered_upload capability in the situations supported by WordPress. On a non-multisite installation it can allow eligible users to upload arbitrary types; on multisite, the capability is limited to a super administrator. The setting disables the normal type checks instead of adding one carefully chosen format.
If you must use it temporarily on a trusted, isolated site for a controlled migration, edit wp-config.php above the line that says WordPress will stop editing, add:
define( 'ALLOW_UNFILTERED_UPLOADS', true );Upload the required file, then remove the line immediately and verify that it is no longer defined elsewhere. Do not leave this enabled on a public production site. An unrestricted uploader may accept executable files such as .php or .sh; if an attacker gains an eligible account, that can become a path to server takeover. The constant is not a substitute for a MIME mapping, malware scanning or access control.
Multisite has an additional policy layer
On WordPress Multisite, network settings can override what an individual site’s administrator adds in code. A network administrator should open Network Admin > Settings > Network Settings and review the field for permitted upload file types. Add only the required extensions there, using the network’s existing comma-separated format, then save and test on the affected site.
Rank #4
- Dual Converters, Infinite Potential：Includes 2× USB C male to USB A female adapters and 2× USB A male to USB C female adapters. Perfect for a wide range of uses—tablets with Bluetooth keyboards, expand USB ports on macbook, and more. Two different converters for all your daily needs
- Next-Level 10Gbps & 3A Charging: No more slow 480Mbps, this usb to usb c adapter has a transfer speed of up to 10Gbps, allowing you to do more transferring in less time. This usb adapter fits both USB A and USB C charger, supporting up to 3A fast charging
- Upgraded Exquisite Craftsmanship: With an aluminum alloy housing and metal connector, the usbc to usb adapter is extremely durable and sturdy. Rigorously tested to withstand more than 10,000 times of plugging and unplugging, ensuring long-lasting performance
- Broad Compatible: The usb c to usb adapter widely supports all USB C/ USB A devices like laptops, tablets, cellphones, car chargers, and phone chargers. Such as compatible with MacBook Pro/Air 2023/2022, Thunderbolt 4/3 Devices,Apple MagSafe Watch 9/8/7/SE/Ultra, iPad Pro 2022/2021, Samsung Galaxy S23/S20/S10, and iPhone 17/16/15 Pro. Plug and play
- Please Note: To reach 10Gbps speed, keep the cable under 3.3 ft. For USB A Male to USB C adapters, try flipping the USB C connector. USB C Male to USB A adapters support bidirectional 10Gbps transfer within 3.3 ft
If the network list excludes a type, an upload_mimes filter or the unfiltered-upload constant may appear to have no effect. Coordinate the change with the super administrator rather than repeatedly changing site-level code. Remember that allowing a type network-wide exposes it to every site that can use that setting.
Security plugins and hosts can reject a file after WordPress allows it
The WordPress MIME list is only one gate. Security plugins can apply their own upload rules, and a web host can block extensions or MIME signatures at the web server, malware scanner or control-panel level.
Check security-plugin settings
If the filter is correct but the same error remains, temporarily review upload and file-protection settings in products such as Wordfence, iThemes Security or All In One WP Security. Prefer an explicit exception for the one extension, and do not disable the plugin globally. Re-enable any test setting as soon as you identify the rule.
Ask the host when the application is not the blocker
A reported case involved a .webm upload that still failed after both a MIME filter and the unfiltered-upload constant were set. That symptom points to a host-level restriction, although the exact cause must be confirmed by the host. Provide the support team with the filename, extension, MIME type, approximate upload time and the WordPress error text. Ask whether ModSecurity, an antivirus scanner, PHP configuration, a maximum-upload rule or a web-server MIME policy is rejecting it.
Free tools Windows power users keep installed
One-click scans. No signup required.
A systematic troubleshooting path
- Reproduce with a known-good sample. Use a small, trusted file with the same extension. If only one file fails, replace or repair that file.
- Check the exact spelling. Confirm that the array key is lowercase and has no dot, and that the MIME value matches the intended format.
- Check PHP placement. A syntax error, a missing opening tag, or code placed in an inactive theme will prevent the filter from running. Review the site’s error log after saving.
- Confirm the filter is active. Verify that the site plugin is activated or that the child theme is active. Do not edit a parent theme and assume the code remains after an update.
- Test with caches and optimizers considered. Clear object or opcode caches only when your host documents the procedure; these caches can keep old PHP code in memory.
- Inspect other upload rules. Review security plugins, host controls and, on multisite, Network Admin’s permitted file types.
- Check the file itself. A renamed executable, malformed font or file with a mismatched signature should be replaced, not forced through validation.
- Remove temporary bypasses. If you enabled
ALLOW_UNFILTERED_UPLOADSfor testing, remove it before continuing diagnosis.
Keep a record of which layer rejected the file. That prevents the common mistake of adding several overlapping filters while an unchanged host rule is the real blocker.
Verify the result and keep the permission narrow
After making a change, upload the file from an administrator account, confirm that it appears under Media > Library, and open the attachment or use it where the site needs it. Then test a clearly disallowed extension to make sure normal protection still works. On a site with multiple user roles, test the least-privileged role that should be able to upload the format.
Best Value
- 5-in-1 Connectivity: Equipped with a 4K HDMI port, a 5 Gbps USB-C data port, two 5 Gbps USB-A ports, and a USB C 100W PD-IN port. Note: The USB C 100W PD-IN port supports only charging and does not support data transfer devices such as headphones or speakers.
- Powerful Pass-Through Charging: Supports up to 85W pass-through charging so you can power up your laptop while you use the hub. Note: Pass-through charging requires a charger (not included). Note: To achieve full power for iPad, we recommend using a 45W wall charger.
- Transfer Files in Seconds: Move files to and from your laptop at speeds of up to 5 Gbps via the USB-C and USB-A data ports. Note: The USB C 5Gbps Data port does not support video output.
- HD Display: Connect to the HDMI port to stream or mirror content to an external monitor in resolutions of up to 4K@30Hz. Note: The USB-C ports do not support video output.
- What You Get: Anker 332 USB-C Hub (5-in-1), welcome guide, our worry-free 18-month warranty, and friendly customer service.
Document the extension, MIME value, reason, date and code location. Review the list when a campaign, theme or integration ends. Removing obsolete permissions reduces the number of file types that an attacker could try to abuse and makes future errors easier to interpret.
Practical examples
Allow a WOFF2 font for a theme
Add woff2 with font/woff2 through upload_mimes. Upload a known-good WOFF2 file. If the extension is allowed but validation still rejects it, apply a narrowly scoped validation filter for WOFF2 and check the server’s reported MIME value. Do not enable unfiltered uploads just to install a font.
Allow JSON for a controlled workflow
Add json with application/json, then limit the capability to trusted users. JSON can contain credentials or other sensitive data, so keep the files out of public URLs when possible and do not upload arbitrary configuration received from an unknown source.
Allow AVIF images
Add avif with image/avif and test both the Media Library upload and the image-processing workflow used by the site. An upload can succeed while thumbnail generation or browser support remains unavailable; that is a separate compatibility issue, not a reason to allow every file type.
Allow SVG only for sanitized assets
Add svg with image/svg+xml only after deciding who may upload it and how it will be sanitized. If there is no reliable sanitization process, keep SVG blocked and use a safer format.
What not to do
- Do not rename
malware.phptomalware.jpgor rely on a misleading extension. - Do not paste code into a parent theme when a child theme or site plugin is available.
- Do not add wildcard or catch-all MIME entries to save time.
- Do not leave
ALLOW_UNFILTERED_UPLOADSenabled after a one-time migration. - Do not assume a successful upload means an SVG, font or configuration file has been scanned for threats.
- Do not repeatedly change WordPress code when a network administrator, security plugin or hosting provider controls the rejecting layer.
The durable solution is a small, documented allowlist entry for the exact type, plus validation and access controls appropriate to that format.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
