How to Fix the “Sorry, This File Type Is Not Permitted for Security Reasons” Error in WordPress

So, you just tried to upload a file to your WordPress website and, instead of successfully uploading, you received an error message that said, “Sorry, this file type is not permitted for security reasons.”

Your first instinct might be to panic. Did you just almost upload a corrupted file to your site? Was it malware? Is your site compromised now?

Don’t worry — while this message might seem ominous, it only means that WordPress does not support the file type you tried to upload. In this post, we’ll examine what causes this error message and look at a few free and easy ways to resolve it.

For instance, let’s say I try to upload an AVIF file to WordPress. AVIF is an image format that stores compressed images. Although this format promises to be a game-changer in image compression, it’s still relatively new and therefore not a popular file format.

WordPress does not support this file type. If I try to upload an AVIF file, I’ll receive the “sorry, this file type is not permitted for security reasons” error. Here’s how that error looks in the Gutenberg editor:

If you only upload file types that WordPress supports, you probably won’t ever see this error message. Next, let’s review what those file types are.

WordPress Allowed File Types

WordPress supports a wide range of file types including the most common images, video, document, and audio formats. These file types are also known as Multipurpose Internet Mail Extensions, or MIME types. MIME types help browsers figure out what type of content has been uploaded to a web page.

If you upload a .jpeg file and .png file, for example, the browser uses their MIME types to determine that these are both image files. Similarly, if you upload a .mp3 or a .wav file, the MIME type signals to the browser that these are audio files.

WordPress supports uploading the following file types:

Images

• .jpg
• .jpeg
• .png
• .gif
• .ico

Document

• .pdf
• .doc, .docx
• .ppt, .pptx, .pps, .ppsx
• .odt
• .xls, .xlsx
• .psd

Audio

• .mp3
• .m4a
• .ogg
• .wav

Video

• .mp4, .m4v
• .mov
• .wmv
• .avi
• .mpg
• .ogv
• .3gp
• .3g2

Note that you can upload HTML files to WordPress in addition to the files listed above. Also, we don’t recommend uploading videos directly to your WordPress media library, since they use up significant storage and can slow down your website. Instead, opt for a video hosting service to store your videos.

These file types are all quite common. However, you may want to upload a file type that’s not on this list. Or, you may be trying to upload one of these permitted file types and still get the “sorry, this file type is not permitted for security reasons” error message.

In either case, there are steps you can take to avoid this error message.

1. Check your file type extension.

Before you start changing your WordPress settings or files, check the extension of the file you’re trying to upload. Maybe you accidentally changed the extension when saving the file. So, the reason you’re seeing the error message is not a problem with your wp-config.php or functions.php file — it’s that you’re trying to upload an image in a video format.

In the example below, I tried to upload a .jpg file as an .avi file and got the error message as a result.

This is an easy first step: If the file name extension is incorrect, then you can fix it and upload the file in the correct format. If it is correct, move on to the next step.

2. Change your multisite network settings.

If you are running a multisite installation — a network of sites that all share the same WordPress installation core files — then you can easily add more allowed file types.

To add a file type, click Settings > Network Settings in your dashboard, then scroll down to Upload Settings. In the input field next to Upload file types, add the extension for the file type you want to upload. Then, save your changes.

Users on any site in your network will now be permitted to upload all the file types listed here.

If you are running a single-site WordPress installation, you won’t have this option in your settings. You’ll need to try one of the steps below.

3. Edit your wp-config.php file to upload any file type.

If you want to permit any and all file types to be uploaded to your site, you just need to add one line of code to your wp-config.php file.

It’s relatively simple to do this, but as a best practice, you should always make a backup of your wp-config.php file before editing. Even a small error in the file can make your site inaccessible.

Once you’ve made a copy of your wp-config.php file, follow the steps below to permit any file type upload.

• Access File Manager via your hosting control panel.
• Open your public_html folder.
• Locate and right-click the wp-config.php file, then choose Edit.
• Scroll to the bottom of the file.
• At the end of the file, you’ll see the line: /* That's all, stop editing! Happy blogging. */. Above this line, paste the following code:

 

define('ALLOW_UNFILTERED_UPLOADS', true);

• Save your changes to the file.
• Log out of WordPress, then sign back in. You should now be allowed to upload any file type.
• Save your changes. You should now be allowed to upload the new file types.

This is a relatively easy solution, but not ideal for every website. If multiple users are uploading files on your WordPress site, for example, you may want to specify which file types are permitted. In that case, keep reading.

4. Edit your theme’s functions.php file to modify permitted file types.

If you want to allow only certain file types to be uploaded to your site, you can use the Upload_Mimes Filter. Here’s how:

• Access File Manager via your hosting control panel.
• Open your wp-content folder.
• Open your themes folder.
• Locate and right-click the functions.php file, then choose Edit.
• Scroll to the bottom of the file and paste the following code:

 

function cc_mime_types($mimes) {
    // New allowed mime types.
  $mimes['svg'] = 'image/svg+xml';
  $mimes['svgz'] = 'image/svg+xml';
  return $mimes;
}
add_filter( 'upload_mimes', 'my_custom_mime_types' );

Note that the code above allows SVG and SVGZ files. You can change or add MIME types to this code snippet depending on what file types you want to upload.

While advanced users won’t have a problem adding code to their functions.php or wp-config.php files, beginners might. In that case, you can use a WordPress plugin as well.

5. Install a plugin to add more permitted file types.

If you’d prefer not to edit your wp-config.php or functions.php files directly, then you can use a plugin to add permitted file types on your website.

WP Add Mime Types and File Upload Types by WPForms are two such plugins. While both are free from the official WordPress directory and highly rated, the File Upload Types plugin is more beginner-friendly. Follow these steps to use it:

• Install and activate the File Upload Types by WPForms plugin.
• Under Settings, click File Upload Types.
• Check the boxes next to the file types you want to upload. The list is pretty long, but you can search for your extension using the search bar in the top right. If your extension isn’t on the list, you can add your own custom file type at the bottom.
• When finished, click Save Settings. You should now be allowed to upload the new file types.

6. Contact your hosting provider.

If you’ve tried all the steps above and are still getting an error message, then contact your WordPress hosting provider support team and describe your issue.

It’s possible that your provider has stricter limits on the file types you can upload than WordPress has by default. In that case, the steps above won’t resolve the “sorry, this file type is not permitted for security reasons” error, but your provider’s customer support likely can.

Securing Your File Uploads

Even though there are ways to get around the “sorry, this file type is not permitted for security reasons” error, that doesn’t mean you should ignore the security issues that WordPress sites can experience. WordPress restricts the file types you can upload because allowing any file type would make it easier for bots and hackers to place malware on your site.

That’s why we recommend specifying which file types you want to allow as to not open your website to any type of file, and consider preventing users with lower roles from uploading files to your site.

Additionally, only upload plugin and theme files downloaded from legitimate sources, as these files are some of the most common causes of compromised WordPress sites. And, conduct regular malware scans for harmful code that may have found its way in via an upload.

For more ways to protect your site from hacking attempts, see our full guide to WordPress security.

Uploading File Types in WordPress

A “sorry, this file type is not permitted for security reasons” error can be frustrating for site admins and users. The good news is that the steps above can either resolve the error or allow you to control which file types you’re able to upload — without compromising the security of your WordPress site.

Editor's note: This post was originally published in January 2021 and has been updated for comprehensiveness.