WordPress blocks SVG uploads by default because an SVG file is technically executable code, not a simple image, which means an unrestricted SVG upload is a genuine way for malicious script content to end up on your site disguised as a logo or icon — the fix isn’t simply removing that restriction, it’s enabling SVG support alongside the specific safeguards that keep it safe to allow. That distinction matters more than it might seem, since a quick search for how to enable SVG uploads in WordPress mostly turns up advice that skips the sanitisation step entirely, treating the restriction as pure inconvenience rather than the deliberate safeguard it actually is.
Why this isn’t a one-step toggle
Simply installing a plugin that unlocks SVG uploads without sanitisation is not a safe self-check to try, since it reintroduces the exact risk WordPress’s default restriction exists to prevent.
What’s worth deciding beforehand is who specifically needs to upload SVGs, since limiting that ability to trusted roles is itself part of doing this safely, rather than opening it up site-wide by default.
It’s also worth thinking honestly about how often SVGs are actually needed on your site, since a genuinely occasional need might be better served by a trusted admin uploading on someone else’s behalf, rather than opening the capability more broadly than necessary. Either approach works, and the right choice mostly comes down to how often the need genuinely arises.
SVG upload security configuration
SVG uploads are blocked by default in WordPress for good reason. We enable them safely, with the specific protections that make it low-risk.
- Full backup taken before we start
- If we can’t fix it, you get your money back
- We never ask for your own password
What we need from you
- Which user roles genuinely need the ability to upload SVG files
- Whether SVGs are needed for a specific purpose, such as icons or a logo, or more broadly
- Confirmation you understand this involves a security tradeoff, managed carefully rather than eliminated entirely
This or something else?
| You want SVG uploads enabled safely, with sanitisation and role restrictions | This fix covers it |
| You’ve already enabled SVGs without sanitisation and want that reviewed for safety | This fix covers it; we assess and correct what’s currently in place |
| You want general upload permissions and file size limits addressed, not SVGs specifically | Media upload failing – permissions & limits, a different fix |
| The concern is a broader security hardening, not this one specific file type | A different, broader security service |
| You just want to upload one SVG file yourself, one time, without ongoing support | Worth checking whether your host or a developer can do a one-off safely first |
What we do
- Configure SVG upload support with proper file sanitisation applied automatically
- Restrict SVG upload ability to the specific user roles that genuinely need it
- Test the sanitisation against a range of SVG files, including deliberately malformed ones
- Confirm legitimate SVGs, such as your logo or icons, upload and display correctly
- Document the configuration so it’s clear what’s been enabled and why
- Report on the security tradeoff involved, in plain terms, so you understand what’s being managed
What is included
- SVG upload support enabled with automatic sanitisation applied
- Upload ability restricted to the roles you specify
- Testing against both legitimate and deliberately malformed SVG files
- A written explanation of the configuration and the security tradeoff involved
Not included
- Enabling SVG uploads without any sanitisation, which we won’t do regardless of request
- A broader site security audit beyond this specific file-type configuration
- Ongoing monitoring of SVG uploads after initial configuration
- Fixing SVGs that render incorrectly for design reasons unrelated to upload security
Questions about this fix
Is it actually safe to allow SVG uploads at all?
With proper sanitisation and role restrictions in place, yes, reasonably — the risk comes specifically from unrestricted, unsanitised uploads, which is exactly what this fix avoids.
Why doesn't WordPress just allow SVGs like other image types?
Because an SVG can contain embedded script code that a JPEG or PNG structurally cannot, so WordPress's core team made a deliberate, conservative default choice rather than an oversight.
Can I let all users upload SVGs, not just admins?
You can, but we'd recommend limiting it to roles you genuinely trust, since broader access widens the pool of accounts that could introduce a malicious file, even unintentionally.
Will sanitisation change how my SVG files actually look?
Properly done sanitisation strips potentially executable content while preserving the visual file, so legitimate icons and logos should display exactly as intended.
What if I already have a plugin that enabled SVGs without sanitisation?
We can review what's currently configured and correct it to include proper sanitisation, rather than needing to start from nothing.
Related fixes
If this is the second time this year
A bad update breaking the site is a symptom of updates not being tested first. Care plans run every update on a staging clone before it reaches your live site, which is the actual fix for this happening again.
Your access, your rules
Create a separate admin account for us and delete it when we are done. For anything else, we get in touch and agree a method — never a form field on this site, never by reply to an email.
We back up first, always
Before anything is touched we take a full backup and keep it for 30 days. If a fix goes wrong, we put the site back exactly as it was.
If it is not what you bought
If the problem turns out smaller than what you ordered, we refund the difference. If it is bigger, we stop and send a quote before doing any extra work.
If we cannot fix it
You get back what we received. Diagnosis is on us — you only pay when the problem is actually solved. The payment processor takes its fee before the money reaches us, so we never hold it and it is not ours to return. That is true here as everywhere else.
If it comes back
Reply within seven days of delivery and we put it back on the bench at no cost. The fix is not finished until it holds.
What we are responsible for
If something goes wrong with a fix, our responsibility is limited to what you paid for it. We take a full backup first so mistakes can be undone, and we tell you before doing anything outside what you bought.