iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
Antihost offers managed WordPress hosting with free migration, one-click staging and a 14-day free trial.
Use WordPress’s upload_mimes filter to allow a specific extension and MIME pair, and keep the change in a plugin or site-specific functionality file so it survives theme changes. Then test a real upload, verify the active allowlist, and validate the file’s contents—not just its filename. On Multisite, a Super Admin must also permit the extension under Network Admin → Settings → Upload file types.
What a MIME type does in WordPress
A MIME type identifies the format a file claims to use. WordPress stores that information as an extension-to-MIME mapping: for example, an extension such as json maps to application/json. Upload handling uses the mapping to decide whether a filename is eligible and, for images, can compare the claimed type with the file’s actual contents.
Recommended Free Tools
Three core functions are useful when diagnosing a MIME problem:
wp_get_mime_types()returns WordPress’s general extension-to-MIME map. The map includes common image, audio, video, document, archive, and OpenDocument formats, and it can change with WordPress core releases.get_allowed_mime_types()returns the types currently allowed for uploads in the active context. This is the map to inspect when an upload is rejected.wp_check_filetype( $filename, $mimes = null )matches a filename against an allowed map and returnsextandtype. If nothing matches, those values are false.
For stronger checking, wp_check_filetype_and_ext( $file, $filename, $mimes = null ) performs the basic mapping and, for images, attempts to determine the real MIME type. Its result contains ext, type, and proper_filename. If your plugin or theme calls this function before the administrative file API has been loaded, include wp-admin/includes/file.php first.
#1 Best Overall
- Read Before You Buy — No Video Output: These adapters support charging and USB 2.0 data transfer, but cannot transmit video signals. Except for standard USB webcams (which use USB data only), they are not compatible with HDMI/DisplayPort cables, video-capable USB-C hubs, or docking stations with video output.
- Convert USB-A Ports to USB-C: Designed to connect USB-C earphones, cables, flash drives, card readers, and other USB-C accessories to standard USB-A ports. Plug-and-play with no drivers or software required.
- Aluminum Alloy Housing: Built with a sturdy aluminum alloy shell that aids in heat dissipation and protects against daily wear and scratches. Designed to maintain a stable and secure connection.
- Compact & Travel-Friendly: The ultra-compact design allows the adapter to stay plugged into your device without blocking adjacent ports or adding bulk, reducing wear and tear on your original USB ports.
- 12-Month Warranty: Backed by a 12-month manufacturer warranty for peace of mind. Designed to meet strict quality control standards for reliable everyday performance.
Choose the correct WordPress hook
WordPress exposes two related filters, but they serve different purposes. Use the upload-specific filter for an upload allowlist; use the general map filter when you need to add a mapping that other MIME lookups should know about.
| Filter or method | What it changes | Typical use | Removal and scope |
|---|---|---|---|
upload_mimes |
The extensions a site can upload | Allow or restrict a precise set of upload types | Remove the entry with the same filter; normally site-specific, with Multisite limits applied afterward |
mime_types |
The general extension-to-MIME map | Add a mapping needed by MIME lookups beyond the upload allowlist | WordPress documents this filter for adding, not removing, types; use upload_mimes when the goal is removal |
| A MIME-management plugin | Usually the upload allowlist through an administrative interface | Sites where non-developers need to manage a small list | Scope, validation behavior, and audit history depend on the plugin; confirm that it uses an allowlist and does not enable every type |
| Hosting or server setting | Web-server handling or a host-level security policy | When WordPress accepts a type but the server blocks, serves, or rewrites it incorrectly | Requires host or server-admin access and is separate from WordPress’s PHP filters |
A filter that changes the WordPress map cannot override a narrower policy elsewhere. A form plugin, security layer, web server, or hosting provider may apply its own allowlist after WordPress has accepted the extension.
Add one MIME type with a site-specific plugin
The safest routine change is a narrow entry in a small plugin or a site-specific functionality plugin. Avoid placing the only copy in a parent or child theme: changing or disabling that theme would silently remove the upload rule.
- Create or open a site-specific plugin. If you maintain a single-purpose plugin, keep the code there; otherwise use the site’s established functionality plugin.
- Add the
upload_mimesfilter and the exact extension-to-MIME pair you need. - Activate the plugin, or deploy the updated file through your normal change process.
- Test the actual upload from the WordPress Media Library or the form that needs the file.
- Record why the type was added and who is allowed to upload it, so the rule can be reviewed later.
<?php
add_filter( 'upload_mimes', function ( $mimes ) {
$mimes['json'] = 'application/json';
return $mimes;
} );This example adds only .json. It does not enable arbitrary extensions, change the file’s contents, or bypass checks performed by another upload layer. Keep the MIME value aligned with the format you intend to accept; an incorrect value can make downstream validation and serving behavior unreliable.
Common examples: JSON, CSV, SVG and WebP
Use one explicit entry per extension. The following values are the conventional mappings demonstrated in WordPress’s filter documentation; verify that each format is appropriate for your site before enabling it.
| Filename extension | MIME value | Important handling note |
|---|---|---|
.json |
application/json |
Allow only if users or an integration genuinely need JSON files in the Media Library. |
.csv |
text/csv |
CSV can contain formulas or sensitive data; limit who can upload and download it. |
.webp |
image/webp |
After enabling, test both upload and the generated image sizes used by your site. |
.svg |
image/svg+xml |
SVG is code-bearing XML. Treat it as an active-content security decision, not merely an image-format preference. |
.svgz |
image/svg+xml |
Compressed SVG still needs the same sanitization and access controls as uncompressed SVG. |
You can add several entries in one filter, but keep the list explicit:
Crashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minutePC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11Rank #2
- 5-in-1 USB-C Hub: Experience comprehensive connectivity featuring a Power Delivery input, two USB-A 2.0 ports, a USB-A 3.0 port, and an HDMI port. (Note: The USB-C power delivery input port is only for connecting an external wall charger to power your laptop and cannot power peripheral devices.)
- 90W Pass-Through Charging: Achieve optimal charging with 90W pass-through power to your laptop, supported by a total input of 100W, with the hub reserving 10W for operational efficiency. (Note: Wall charger not included.)
- Quick Data Transfers: Accelerate your productivity with rapid data transfers using a high-speed 5Gbps USB 3.0 port and two 480Mbps USB 2.0 ports.
- 4K HDMI Display: Enhance your visual experience with a hub capable of delivering 4K resolution at 30Hz in both mirror and extend modes. Please note that this hub is compatible with MacBook (macOS 12 and newer), Windows 10 and 11, ChromeOS, and laptops equipped with DP Alt Mode and Power Delivery. Note: This device is not compatible with Linux.
- What You Get: Anker USB-C Hub (5-in-1, 4K HDMI), welcome guide, 18-month warranty, and our friendly customer service.
<?php
add_filter( 'upload_mimes', function ( $mimes ) {
$mimes['json'] = 'application/json';
$mimes['csv'] = 'text/csv';
$mimes['webp'] = 'image/webp';
return $mimes;
} );Do not use a wildcard or a rule that accepts every extension. A broad rule makes it harder to audit the site and increases the chance that an executable or code-bearing file reaches a publicly accessible directory.
Confirm that WordPress loaded the rule
When an upload still fails, first determine whether the filter is active and whether the entry survived later restrictions. Inspect the map in a controlled administrative context rather than printing it on a public page.
<?php
$allowed = get_allowed_mime_types();
error_log( print_r( $allowed, true ) );Search the log for the extension and confirm that its MIME value is exactly the one your filter added. If it is absent, check these common causes:
- The plugin containing the filter is inactive or has a PHP parse error.
- The code was placed in a file WordPress never loads.
- The extension key contains a typo, an unwanted dot, or a pattern that does not match the filename.
- Another filter runs later and removes or replaces the entry.
- You are testing a different site, environment, or network than the one where the code was deployed.
After confirming the map, upload a small, known-good file with the exact extension. A successful map lookup does not prove that the file’s bytes match the extension, nor does it prove that a form plugin or server will accept the request.
Do these 3 things before closing this tab:
1Clear out junk files and repair common Windows errors2Fix the driver behind crashes, sound loss and screen glitches3Repair Windows errors before they cause bigger problemsFix “Sorry, this file type is not permitted for security reasons”
The message means that at least one upload layer rejected the file. Work through the checks in order so you do not loosen security unnecessarily.
1. Check the filename and intended MIME pair
Confirm that the filename ends with the extension you are allowing and that your code uses the correct MIME string. Rename only when the file really is that format; changing .txt to .json does not convert its contents.
Rank #3
- Sleek 7-in-1 USB-C Hub: Features an HDMI port, two USB-A 3.0 ports, and a USB-C data port, each providing 5Gbps transfer speeds. It also includes a USB-C PD input port for charging up to 100W and dual SD and TF card slots, all in a compact design.
- Flawless 4K@60Hz Video with HDMI: Delivers exceptional clarity and smoothness with its 4K@60Hz HDMI port, making it ideal for high-definition presentations and entertainment. (Note: Only the HDMI port supports video projection; the USB-C port is for data transfer only.)
- Double Up on Efficiency: The two USB-A 3.0 ports and a USB-C port support a fast 5Gbps data rate, significantly boosting your transfer speeds and improving productivity.
- Fast and Reliable 85W Charging: Offers high-capacity, speedy charging for laptops up to 85W, so you spend less time tethered to an outlet and more time being productive.
- What You Get: Anker USB-C Hub (7-in-1), welcome guide, 18-month warranty, and our friendly customer service.
2. Inspect the active allowlist
Use get_allowed_mime_types() in an administrative diagnostic and verify that the extension appears. If it does not, fix plugin loading or the filter before investigating the file itself.
3. Check Multisite restrictions
On Multisite, the network setting can narrow the types available to each site. A Super Admin must open Network Admin → Settings → Upload file types and add the extension to the network allowlist. WordPress’s check_upload_mimes() intersects the core map with the network upload_filetypes option. Its documented default is jpg jpeg png gif; a site-level filter cannot grant a type that the network setting excludes.
Free tools Windows power users keep installed
One-click scans. No signup required.
4. Check the actual file and image metadata
If the extension is present but the upload is rejected, inspect the file’s contents and metadata. wp_check_filetype_and_ext() can detect an image whose content does not match its extension. For some image mismatches it returns a corrected value in proper_filename. Use that result deliberately: do not suppress a mismatch simply to force an upload through.
5. Check other upload layers
A form plugin may have its own accepted-file list. Security software, a reverse proxy, the web server, or a hosting policy may also block the request. Compare the failing form with a direct Media Library upload: if only the form fails, inspect that form’s settings; if both fail, continue with network, server, and file-content checks.
Validate custom uploads, not just Media Library uploads
Any custom endpoint, AJAX handler, REST route, or front-end form must perform its own validation. Do not assume that a MIME filter applied to the Media Library automatically protects a custom uploader.
<?php
if ( ! function_exists( 'wp_check_filetype_and_ext' ) ) {
require_once ABSPATH . 'wp-admin/includes/file.php';
}
$allowed = array(
'json' => 'application/json',
'csv' => 'text/csv',
);
$filename = sanitize_file_name( $incoming_name );
$check = wp_check_filetype_and_ext( $temporary_path, $filename, $allowed );
if ( empty( $check['ext'] ) || empty( $check['type'] ) ) {
// Reject the upload and return a safe error response.
}
The sequence matters: sanitize the filename before examining its extension, pass a narrow allowlist, and reject when WordPress cannot establish both an allowed extension and MIME type. For image uploads, review the result of the real-content check rather than trusting a user-supplied header or filename.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Rank #4
- Dual Converters, Infinite Potential：Includes 2× USB C male to USB A female adapters and 2× USB A male to USB C female adapters. Perfect for a wide range of uses—tablets with Bluetooth keyboards, expand USB ports on macbook, and more. Two different converters for all your daily needs
- Next-Level 10Gbps & 3A Charging: No more slow 480Mbps, this usb to usb c adapter has a transfer speed of up to 10Gbps, allowing you to do more transferring in less time. This usb adapter fits both USB A and USB C charger, supporting up to 3A fast charging
- Upgraded Exquisite Craftsmanship: With an aluminum alloy housing and metal connector, the usbc to usb adapter is extremely durable and sturdy. Rigorously tested to withstand more than 10,000 times of plugging and unplugging, ensuring long-lasting performance
- Broad Compatible: The usb c to usb adapter widely supports all USB C/ USB A devices like laptops, tablets, cellphones, car chargers, and phone chargers. Such as compatible with MacBook Pro/Air 2023/2022, Thunderbolt 4/3 Devices,Apple MagSafe Watch 9/8/7/SE/Ultra, iPad Pro 2022/2021, Samsung Galaxy S23/S20/S10, and iPhone 17/16/15 Pro. Plug and play
- Please Note: To reach 10Gbps speed, keep the cable under 3.3 ft. For USB A Male to USB C adapters, try flipping the USB C connector. USB C Male to USB A adapters support bidirectional 10Gbps transfer within 3.3 ft
Wordfence’s upload-security guidance likewise recommends an allowlist, filename sanitization, and wp_check_filetype_and_ext() or, at minimum, wp_check_filetype() for custom upload features. These checks identify a format; they do not make dangerous content safe to display.
Security decisions for code-bearing formats
Some formats deserve additional controls even when WordPress recognizes their MIME type.
- SVG: SVG is XML that can contain active elements and references. Permit it only for trusted roles or a controlled workflow, sanitize it with a purpose-built process, and consider serving sanitized copies rather than original uploads.
- HTML and similar document formats: These can execute or embed content in a browser. Do not add them to a routine media allowlist unless you have a specific isolation and access-control plan.
- JSON and CSV: These are not executable by WordPress merely because they are uploaded, but they can expose data or carry spreadsheet formulas when opened elsewhere. Restrict uploaders and review download permissions.
- Archives: A permitted archive can contain unexpected nested files. If users can upload archives, inspect and process them in a controlled location rather than extracting them directly into a publicly served directory.
Never enable ALLOW_UNFILTERED_UPLOADS as a routine fix. An “allow everything” setting removes the purpose of the allowlist and can turn a simple content requirement into a server-side code-upload risk.
Removing, changing and auditing a MIME rule
To remove a type you previously added, use the same upload_mimes filter and unset the exact key:
Quick wins for a faster PC:
Repair Windows errors before they cause bigger problemsFix Now →Scan for outdated or missing drivers - takes under a minuteDriver Scan →Clear out junk files and repair common Windows errorsFree Scan →<?php
add_filter( 'upload_mimes', function ( $mimes ) {
unset( $mimes['json'] );
return $mimes;
} );Remove or update the original rule instead of leaving conflicting filters in several plugins. After a change, inspect get_allowed_mime_types(), test an existing file and a new upload, and check whether previously uploaded files still need to be retained. Removing an extension from the allowlist does not automatically delete files already stored in the Media Library.
Keep a short record of the extension, MIME value, business reason, approving administrator, date, and intended uploader roles. This makes a later security review possible and helps identify obsolete exceptions.
Best Value
- 5-in-1 Connectivity: Equipped with a 4K HDMI port, a 5 Gbps USB-C data port, two 5 Gbps USB-A ports, and a USB C 100W PD-IN port. Note: The USB C 100W PD-IN port supports only charging and does not support data transfer devices such as headphones or speakers.
- Powerful Pass-Through Charging: Supports up to 85W pass-through charging so you can power up your laptop while you use the hub. Note: Pass-through charging requires a charger (not included). Note: To achieve full power for iPad, we recommend using a 45W wall charger.
- Transfer Files in Seconds: Move files to and from your laptop at speeds of up to 5 Gbps via the USB-C and USB-A data ports. Note: The USB C 5Gbps Data port does not support video output.
- HD Display: Connect to the HDMI port to stream or mirror content to an external monitor in resolutions of up to 4K@30Hz. Note: The USB-C ports do not support video output.
- What You Get: Anker 332 USB-C Hub (5-in-1), welcome guide, our worry-free 18-month warranty, and friendly customer service.
Which approach fits your site?
| Situation | Recommended approach | Why |
|---|---|---|
| One site needs one or two additional formats | A narrow upload_mimes filter in a site-specific plugin |
It is explicit, versionable, and easy to remove without changing the theme. |
| Several sites in a network need the same format | Network-level approval plus the site-specific filter where required | The network allowlist is an upper boundary; individual sites cannot exceed it. |
| Editors must manage a changing list without code access | A reputable MIME-management plugin with documented validation | Use only if its scope, content checks, permissions, and audit behavior are clear. |
| WordPress accepts the file but delivery or processing fails | Inspect server, host, CDN, image-processing, and form-plugin policies | The failure may be outside WordPress’s MIME map. |
| A custom uploader accepts user files | Implement an explicit allowlist and call WordPress validation functions | Media Library settings alone do not secure a separate upload endpoint. |
A practical verification checklist
- Identify the exact extension and its intended MIME value.
- Add only that pair through
upload_mimesin a plugin or site-specific functionality location. - Confirm the filter is loaded and the entry appears in
get_allowed_mime_types(). - For Multisite, have a Super Admin permit the extension in Network Admin settings.
- Test a known-good file through the exact upload route your users will use.
- For custom upload code, sanitize the filename and validate with
wp_check_filetype_and_ext()orwp_check_filetype(). - Review SVG, HTML, archives, and other code-bearing formats for additional sanitization and access controls.
- Check form plugins, security layers, web servers, and hosting policies if WordPress’s map is correct but the request still fails.
- Document the exception and remove it when the business need ends.
Frequently asked questions
Does adding a MIME type convert an existing file?
No. The filter changes which filenames and formats WordPress will consider for upload. It does not transcode, rewrite, or repair the file’s contents.
Why does the filter work on one site but not another in the same network?
Multisite applies the network’s upload_filetypes restriction when calculating each site’s allowed map. A Super Admin must approve the extension at the network level before a site-level filter can use it.
Should I use mime_types instead of upload_mimes?
Use upload_mimes when your goal is to change what users may upload. The mime_types filter is intended for adding entries to the general map; WordPress documents upload_mimes for removing or restricting upload types.
Why can an image with the right extension still be rejected?
WordPress can compare an image’s actual type with its filename extension. If the bytes or metadata do not match, wp_check_filetype_and_ext() may reject the file or provide a corrected filename in proper_filename.
Can I allow every file type temporarily while troubleshooting?
Do not use an unrestricted upload setting as a troubleshooting shortcut. Find the specific map, network, content-validation, form, server, or host policy that is rejecting the intended format and permit only that extension.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
