WordPress rejects a file type: three ways to unblock the upload

Understand the rejection before changing WordPress

You drop a logo, document or photo into the media library, then WordPress reports that this file type is not allowed. The wording may refer to security reasons or a lack of permission. This message does not automatically mean that your account is configured incorrectly. It may also reveal a genuinely prohibited format, a misleading extension or a site-specific restriction.

Start by recording the full message, filename and screen used. Adding a file under Media, importing a page template and uploading through a form do not necessarily follow the same rules. A file accepted by a specialized importer may still be rejected by the media library without the library being broken.

Keep the original on your computer and work on a copy. The first checks require neither an extra plugin nor a server change. If WordPress instead mentions a maximum size, temporary folder or inability to process an image, start with the corresponding message: allowing a format does not fix those other errors.

Choose the right approach for your file

To display an illustration or provide a document to read, converting it to a common format is often enough. This is the first approach: it meets the reader’s need without broadening what can be uploaded to the site. A logo properly exported as PNG can therefore be suitable when a vector version is not essential.

If a common file, such as JPEG or PDF, is rejected while similar files usually work, move on to diagnosis. The second approach compares simple tests to distinguish the document, account and entry point responsible. It avoids adding permission that already exists.

The third approach addresses a confirmed need: a format excluded by the network or a specialized file that truly must be preserved. Permission should then cover that format and the people concerned. First define the intended use: display, download, import into a tool or private storage. The public media library is not automatically suitable for all four uses.

Approach 1: convert an image without installing a plugin

This approach suits someone who has the file and can add media. It requires a local application that reads the original and access to Media in WordPress. Open the copy in the application that created the image or in a local editor able to read its format. Use Export or Save a Copy, then explicitly choose the output format. For a photo, JPEG is a simple test. For a drawing with a transparent background, PNG can preserve that transparency. The choice depends on the result you need.

Check the dimensions before exporting. A small icon does not need the same file as an illustration intended to span the full width of a page. Choose sufficient resolution, then inspect text, edges and colors in the exported copy. If the image is animated, make sure conversion does not remove animation needed to understand it.

The procedure ends with an actual test in WordPress. A correct preview on the computer does not yet prove that the site accepts the file. Upload the copy under Media, open its details, then place it in a draft. Keep the original for future adaptations, even if you eventually publish the converted version.

The expected result is a genuinely converted copy that displays correctly in a draft. If its appearance is unsuitable, remove it from the draft and export again from the original; do not replace the source file. An unused reference media item can be deleted after checking where it is used.

1. Export a new copy in the chosen format, with a simple name and a single final extension.
2. Close and reopen the copy in your application to check that it can be read correctly.
3. Upload only this version to the media library and wait for the complete result.
4. Check its appearance on the page, especially sharpness and transparent areas.

Why changing the suffix does not convert anything

A file’s name and its contents are two different things. Replacing .heic with .jpg in the name does not turn the data into JPEG. Likewise, adding .pdf to an archive does not create a PDF document. WordPress compares allowed extensions with the type it can recognize; an inconsistency can cause rejection.

Show full extensions in your file manager. Without that display, a copy may appear to be named logo.png while its real name ends in logo.png.svg. Also look at the type reported by the original application. If the file comes from an incomplete download or interrupted export, recreate it from the original instead of repeatedly renaming it.

A short name makes diagnosis easier, but it does not make a file trustworthy. Do not open a document from an unknown source solely to discover its type. Ask its author for a new export. For an internal or confidential document, prefer local tools already approved by your organization, without sending it to a public converter just for this test.

Convert a document while preserving its usefulness

For a brochure, quotation template or instruction sheet intended for reading, export a PDF from the original application. Check the pages after export: cropped tables, substituted fonts and lost links can make a technically accepted document difficult to use. Also try selecting text when that capability is expected.

Conversion must preserve the file’s purpose. If the reader needs to edit a table, a PDF does not necessarily replace the workbook. If a form contains fields to fill in, check that they remain active. A file intended for reimport into an application may require its original format; in that case, continue with the targeted-permission approach.

Do not routinely turn the document into a ZIP archive to bypass the check. This changes the download experience, sometimes hides the real problem and does not remove content-related risks. For a theme or plugin archive, use WordPress’s designated installation screen. Putting it among media files neither installs it nor fixes an installation failure.

Approach 2: compare three simple tests

This approach suits the account encountering the rejection and having access to Media → Add New Media File. It changes no setting. When the format appears to be allowed already, prepare a very simple reference file. For example, export a small JPEG image from a local application, or a one-page PDF containing text without sensitive data. Avoid reusing an old file of unknown origin: the file must provide a reliable comparison.

Run the tests with the same account in the same media library. Record the name, time and exact result for each one. If the reference file of the same format works, the problem probably concerns the original file or its particular characteristics. If several clean files of that format fail, examine the site restrictions and upload path.

One isolated success is a clue, not a complete diagnosis. An image’s size or processing may come into play after the format check. Note the stage at which the message appears and avoid grouping all upload failures under a single label.

The expected result is a useful comparison: only the original fails, every file of that format fails, or all uploads fail. Keep the exact messages. There is no setting to undo; remove reference media only if no content uses it.

1. Try the original file under Media, then Add New Media File, without going through a page builder.
2. Next, try the small reference file of the same format on that same screen.
3. Finally, try a small, common file in another format to see whether the rejection affects every upload.

Check the account without granting excessive rights

The right to upload media depends on account capabilities. Under standard WordPress roles, a contributor does not have the same abilities as an author or editor. Plugins or a particular configuration can also change these capabilities. The displayed role name therefore does not always tell the full story.

Ask an authorized administrator to try the same reference file with their own account. Do not share a password. If their test works and yours fails, record your respective roles and have the upload permission and format-specific restrictions examined.

Under Users, the administrator can check the assigned role. They should compare it with your actual work on the site. Promoting a contributor to administrator merely to upload a file would grant far more abilities than necessary. An appropriate permission or a workflow in which an editor adds media may be enough.

If the administrator’s account also fails, stop changing roles. Return to the file, network settings and any form rules. This result narrows the investigation and should be kept in your notes.

Distinguish the media library from a form or importer

A contact form may intentionally limit attachments to a few formats. A page builder may expect a precise structure in a JSON file. In these situations, acceptance by the media library does not demonstrate that the file is suitable for the other tool. Its contents can be valid while not matching the requested use.

If rejection happens only in a form, open its settings and find the list of allowed extensions for the relevant field. Compare it with your needs and the tool’s documentation. A restriction on a public form deserves particular care: its audience is wider than the people signed into the administration area.

If the rejection affects a template import, check the version of the tool that exported the file and the version that needs to read it. Export it again in the explicitly supported format. Do not change the general media list to solve an internal-structure problem that this list does not control.

Identify a recently added restriction

A format accepted yesterday can be blocked after a change to security rules or the upload system. Reconstruct changes close to the first failure: a new plugin, update, theme change, migration or form modification. Keep the reference file so you can compare identical conditions.

On a backed-up test copy, you can temporarily deactivate the suspect component and upload again. Proceed one component at a time, then reactivate it to check whether rejection returns. One successful attempt after several simultaneous changes does not reveal which change mattered.

Do not perform a blanket deactivation on a functioning store. If you have no test environment, send the results to the technical lead. Give them the component version, affected format and time the regression appeared. A documented fix or targeted setting is preferable to leaving a protection disabled indefinitely.

Approach 3: correct a format list in a multisite network

In a WordPress multisite network, allowed types may be limited by network administration. This path is for the super administrator, with access to My Sites → Network Admin → Settings → Network Settings. A site administrator does not necessarily have this access. The change affects the network; confirm the need before applying it.

The allowed-types field restricts types that WordPress already knows. Adding an unknown suffix there guarantees neither recognition nor processing. The expected result is that the reference file uploads with the usual account on the relevant site. If rejection persists, restore the original value in the same field and save. Do not stack permissions in an attempt to force success.

1. Open network settings and scroll to the upload settings.
2. Find the allowed upload file types field and copy its current value into your notes.
3. For a common format already recognized and approved for your network, add only its missing extension, without a dot and separated from the others by a space.
4. Save the changes.
5. Return to the affected site with the usual account and upload the reference file from Media → Add New Media File.
6. Note the result and restore the previous list if this addition does not meet the need.

Add support for a specialized format

Before adding a missing type, write down the concrete need: which file, produced by which application, uploaded by whom, for which audience and how often? This description distinguishes a real site feature from a one-off upload that could be prepared differently.

On an installation maintained by a developer, the upload_mimes filter can adjust the list of extensions and MIME types. It does not transform the content, remove dangerous elements or guarantee server compatibility. A correct change must preserve file checks and be tested with the account that will actually be used.

Do not copy a snippet that accepts every type or systematically replaces the validation result with success. In particular, avoid globally enabling ALLOW_UNFILTERED_UPLOADS as a troubleshooting fix. A legitimate format deserves a limited, maintainable rule. For private files, also choose storage with genuine access control: adding a media item to a protected post is not enough to guarantee that its URL is confidential.

The special case of SVG: conversion or a dedicated plugin

An SVG describes a vector image and may contain active content. If you only need to display a logo, start with a PNG export at an appropriate resolution. Keep the vector original for graphic design work. The first path explains how to check that copy without allowing an additional format.

When SVG is essential, Safe SVG, published by 10up, provides sanitization and a choice of roles allowed to upload it. This option is for an administrator authorized to install a plugin and change settings, first on a backed-up copy. As of November 2, 2026, its listing states version 2.5.2, a minimum of WordPress 6.9 and PHP 7.4, and declared compatibility up to WordPress 7.1.4. Check these requirements before installing the plugin.

In this version, the setting is under Settings → Media, in Safe SVG Settings, in the User Roles field. Translations may vary. It offers the roles that can already upload files. The choice applies to every member of the selected roles on the site, not to an individual person. Photograph or note the initial checkboxes so that you can restore them.

1. On the copy, open Plugins → Add New Plugin, search for Safe SVG, and verify the publisher 10up and the official listing.
2. Install and activate the plugin if the prerequisites are met.
3. Open Settings → Media and find Safe SVG Settings, then User Roles.
4. Leave checked only the roles you want to allow to upload SVG files; uncheck the others.
5. Click Save Changes and reopen the page to check the selection.

Check both accounts and retain a way to roll back

Saving the selection matters: until a choice has been saved, Safe SVG defaults to the general permission to upload files. After configuration, it checks a specific capability. An account with several roles or custom permissions may therefore need further examination. For a meaningful check, choose two ordinary accounts that can already upload a JPEG, one with an allowed role and one with an excluded role. Avoid using the network super administrator as the rejection reference.

Use a small, self-contained SVG created by your team, without private data or resources loaded from another site. The expected result is acceptance for the first account and rejection for the second, while JPEG remains accepted for both. This check concerns new uploads; the restriction does not make SVG files already accessible at their URLs private.

Sanitization can alter the drawing and does not remove the need to check its appearance. A third-party form or importer using its own upload path requires a separate check. Do not compensate for a rejection by globally allowing the SVG type. External-reference removal is not enabled by default in this version: a sanitized SVG therefore does not guarantee the absence of requests for remote images or fonts.

To undo the setting, restore the checkboxes recorded under Settings → Media and save. If you abandon the trial of the newly installed plugin, first remove the SVG from the draft and check its uses before deleting only the reference media item. Deactivation must not be presented as deleting or sanitizing older files.

1. With the allowed account, open Media → Add New Media File and upload the reference SVG.
2. Open its details and insert it into a draft to check shapes, text and colors.
3. Sign out of that account and sign into the excluded account, or use another browser profile. Do not share credentials.
4. On the same Media screen, attempt a new upload of the same SVG and record the rejection.
5. Upload a reference JPEG with this second account to distinguish SVG rejection from a general lack of upload permission.
6. If the SVG works for the excluded account, stop this rollout and have its roles, capabilities and any custom filters examined on the copy.

Compare a reference logo with its PNG or WebP export

Under Media > Add New Media File, upload two exports of the same small drawing created locally. Use a simple SVG containing a shape and a copy genuinely exported as PNG. If your editor exports WebP, add that variant. Keep the same width and a transparent background if the drawing needs one. Give the files short names, then reopen the exported images in the editor to check size, edges and transparency. Keep the vector drawing in its working folder.

On a standard WordPress installation without an SVG upload plugin, the vector format is excluded from the native list. Rejection of the SVG alone, while a PNG export of the same drawing is accepted by the same account, matches this behavior. Failure of both reference files calls for another check. Open the Network tab in the browser tools, repeat a single test, and record the upload request’s response. An HTML 413 message before processing may indicate a server or intermediary limit. A WordPress response about the file type points back to MIME policy and content validation. Record the full message, time and screen used.

When the aim is to display the logo, add the PNG or WebP to a draft at the intended size. Check its appearance on light and dark backgrounds, and on a narrow screen. A successful WebP upload is not enough if the preview or derived size is missing. To return to the previous version, remove the reference block or restore the original media item in the draft. Remove only the test files from the media library whose uses you have checked.

Check the file retained after sanitization

On the copy, first test with a small, homemade SVG containing only a drawing. Then test a copy with a static HTML annotation, without a script or link, inside a foreignObject element. This second reference file checks a transformation of the file even if the main drawing looks identical in the media library. Do not run this test with an SVG downloaded or sent by a visitor.

Once the allowed role is configured in Safe SVG, record the URL and download the media-library file from the copy. Compare it with the starting file in a text editor. Check whether the shape is preserved and whether the element outside the sanitization allowlist has disappeared. Then open a draft and check how your drawing actually renders. If an essential element has disappeared or your upload tool follows another path, return to PNG or WebP for this use.

To check the restriction, repeat the test with a second account that can already add a PNG but whose role has been excluded from SVG uploads. The expected result is PNG acceptance for both accounts and SVG acceptance only for the allowed role. An account without general upload permission is a separate reference case. On multisite, the network list and the super administrator’s special privileges require a separate check.

Read the acceptance-test results

To document your own acceptance test, record SVG, PNG and WebP acceptance separately for the same account. Without SVG support, an SVG being rejected while PNG works does not demonstrate an upload failure. However, if every file fails, examine the upload path. A request body exceeding the PHP limit can prevent the expected data from reaching WordPress; do not confuse this with an SVG sanitization decision.

With Safe SVG, compare behavior before and after explicitly saving the allowed roles. The excluded account should retain JPEG uploads if it still has that general right while losing SVG uploads. Check the stored file after sanitization, not just its preview. Note the installed version and any element removed from the drawing. These checks are the acceptance test to perform on your copy; they are not presented here as validation of every third-party import path.

After deactivation, check a new upload and a previously stored file separately: removing upload capability does not delete existing media. To undo the test, restore the original roles, remove the reference blocks, and check their uses before deleting only the media created. If the copy is disposable, restoring its initial state lets you repeat the comparison with the native policy.

Adapt the tests to WordPress.com

On WordPress.com, the list of formats and additional possibilities also depend on the plan and enabled features. Do not directly apply a standalone-server procedure to this service. Check accepted formats in the account’s help pages and the conditions applying to the relevant media type.

A form upload may also follow a different list from the media library. Therefore repeat the tests with a reference file and the correct screen before concluding that something is broken. If the format is listed as supported but still fails, send support the full message, your plan and an example without private data.

Local conversion remains a useful first solution when the output format meets the need. However, do not assume that purchasing a plan or an additional plugin is necessary solely because of a generic message. Have the exact restriction confirmed before changing your plan.

Confirm the resolution and keep a clear rule

The right result includes two checks: your legitimate file reaches the media library and it works in its publishing context. Open its details, add it to a draft, then test the image or download. For a document, check the resulting contents, not just its name in the media list.

Finally, repeat the test with the account that will perform future uploads. Success achieved only with a more privileged account can hide the original problem. Note the chosen solution: export format, corrected role, form restriction, network list or specialized support.

Remove experimental settings that are no longer needed and restore components deactivated during diagnosis. If a converted copy is enough, keep a simple instruction for the team: export application, format and checks to perform. Future media can then follow a repeatable procedure without reopening WordPress’s entire configuration each time.