How to Fix “Sorry, This File Type Is Not Permitted for Security Reasons” Error in WordPress

Have you ever tried uploading a file to your WordPress Media Library and hit this error?

“Sorry, this file type is not permitted for security reasons.”

This is a common (and frustrating) issue, especially if you’re uploading custom files like fonts, SVGs, or other non-standard formats. Thankfully, there are safe and easy ways to fix it – without breaking your site’s security.

In this guide, you’ll learn:

• Why WordPress blocks certain file types

• Two proven ways to fix the issue (plugin and manual method)

• Specific plugins for SVGs and advanced cases

• Security tips before allowing uploads

• Common file types WordPress does and doesn’t allow

🧠 Why You’re Seeing This Error

WordPress restricts the types of files you can upload by default. This is to protect your site from malicious code, since files like .exe, .php, or unsanitized .svg files can be exploited by attackers.

When you try to upload a file that isn’t on WordPress’s approved MIME types list, you’ll see an error like:

“Sorry, this file type is not permitted for security reasons.”
or
“[filename] has failed to upload.”

Here are the file types WordPress does allow by default:

✅ Supported File Types

Images: .jpg, .jpeg, .png, .gif, .ico
Documents: .pdf, .doc, .docx, .ppt, .pptx, .pps, .ppsx, .odt, .xls, .xlsx, .psd
Audio: .mp3, .m4a, .ogg, .wav
Video: .mp4, .m4v, .mov, .wmv, .avi, .mpg, .ogv, .3gp, .3g2

Any other file type – like .woff (web font), .svg, or .epub – will be blocked.

🚀 Quick Fix Options (Summary)

Before diving in, here’s a snapshot of the two best ways to fix the error:

🔧 Fix 1: Enable All File Types via wp-config.php

This method is best for developers or site admins who need complete control.

⚠️ Warning: This bypasses WordPress’s security checks for file types. Only use if you fully control your site and trust all users.

Steps:

1. Connect to your website using FTP or your hosting control panel’s file manager.

2. Locate your wp-config.php file in the root directory (same folder as wp-content and wp-admin).

3. Open the file and scroll to the bottom.

4. Just above the line:

   /* That’s all, stop editing! Happy blogging. */

…add this line:

1. Save the file and re-upload.

2. Log out and back into WordPress.

🧩 Fix 2: Use the WP Extra File Types Plugin (Easy & Safe)

1. Go to Plugins → Add New

2. Search for “WP Extra File Types”

3. Click Install → Activate

4. Go to Settings → Extra File Types

5. Tick the file types you want to allow

6. Click Save Changes

🔗 WP Extra File Types Plugin

🖼 Bonus: Upload SVGs Safely in WordPress

SVGs are blocked by default because they can include unsafe code. But they’re great for logos and icons.

Use the Safe SVG Plugin

• Search for and install Safe SVG from Plugins

• Activate it – you’re done

• It automatically sanitizes SVGs on upload

🔗 Safe SVG Plugin

⚠️ Important Notes Before Enabling Uploads

🔐 Security

Unfiltered uploads can be dangerous. Only allow it if:

• You control all user accounts

• You’re not letting visitors upload files

• You have a security plugin and backups

📦 Backup First

Always create a backup before editing files or adding unrestricted upload settings.

📏 File Size Still Matters

Even with allowed types, a large file can still fail to upload.
Check your server’s upload_max_filesize and post_max_size.

📖 How to Increase WordPress Upload Size

❓ Common Questions

Can I upload fonts like .woff, .ttf, .otf?
Yes – use the WP Extra File Types plugin and tick those formats.

Are SVGs safe to upload?
Only with the Safe SVG plugin, which sanitizes the code.

Is ALLOW_UNFILTERED_UPLOADS safe?
No – not for multi-user or client-facing sites. Use only if you fully control the environment.

✅ Recap

• WordPress blocks unusual file types by default.

• Use wp-config.php for total control (but high risk).

• Use WP Extra File Types for a safe, dashboard-only method.

• Use Safe SVG if you want secure vector uploads.

Now you can upload fonts, custom icons, or anything else WordPress used to block – without hassle.

🙋‍♂️ Frequently Asked Questions (FAQ)

❓ Why does WordPress block certain file types?

WordPress blocks some file types to protect your site from potentially harmful code. File formats like .svg, .exe, or .php can contain scripts or malicious payloads, which is why they’re not allowed by default. This helps prevent attacks and keeps non-technical users safe.

❓ What is the safest way to allow additional file types?

Using a plugin like WP Extra File Types is the safest method. It lets you enable only the file types you need – without editing code or exposing your site to broader risk.

❓ What happens if I use ALLOW_UNFILTERED_UPLOADS?

Adding define('ALLOW_UNFILTERED_UPLOADS', true); to your wp-config.php file allows all file types to be uploaded – including dangerous ones. This is risky if other users (clients, contributors, editors) have Media Library access. Only use this on locked-down, admin-only sites.

❓ Can I upload fonts like .woff or .ttf?

Yes! WordPress blocks them by default, but you can enable them easily using the WP Extra File Types plugin. Tick the box for .woff, .woff2, or .ttf and click Save Changes. Now you can upload custom fonts for your theme or page builder.

❓ Why won’t my file upload even after enabling the type?

Check the file size. Even if the type is allowed, uploads can fail if:

• The file is too large

• upload_max_filesize in PHP settings is too low

• post_max_size is smaller than the file size

• NGINX or Apache is enforcing limits

Increasing these values (via php.ini, .htaccess, or hosting control panel) usually resolves this.

❓ How do I enable SVG uploads securely?

SVGs are powerful but can include embedded scripts. Use the Safe SVG plugin – it sanitizes SVG files on upload, removing malicious code and letting you safely use vector graphics across your site.

❓ Will these changes survive WordPress updates?

Yes. Changes made in your wp-config.php file or via plugins like WP Extra File Types and Safe SVG are persistent and won’t be overwritten by updates. Just keep the plugins updated for maximum compatibility and security.

❓ Can I let users upload custom file types on the front end?

Yes, but it’s risky. If your site has user submissions (via forms or front-end uploads), avoid using ALLOW_UNFILTERED_UPLOADS. Instead, tightly control file types via a plugin like WP Extra File Types, or handle uploads with form plugins that include security filters.

🧾 Sources & References

• Accepted File Types – WordPress.org

• Editing wp-config.php – WordPress Support

• WP Extra File Types Plugin

• Safe SVG Plugin