Upload the file types WordPress blocks by default
File Upload Types unlocks SVG, AVIF, HEIC, WOFF web fonts and OBJ 3D models in the media library, each switchable on its own, with every SVG sanitized on upload.
- Five file types, each enabled independently.
- Every SVG stripped of scripts and dangerous code before storage.
- Gzip-compressed SVGZ stays out, since it can't undergo the same inspection.
- Limit upload permission to specific roles per file type.
What does File Upload Types do?
When any file type is enabled in the media_upload_types module, TOWP_Media_Upload_Types filters upload_mimes to add that type's MIME signature to WordPress's allowed list, and wp_check_filetype_and_ext to correctly identify files PHP's own detection sometimes misses. SVG gets an additional layer: wp_handle_upload_prefilter parses every uploaded SVG as XML, strips any element not on an explicit safe list, removes every event-handler attribute, and restricts href-like attributes to fragment references or embedded image data, before saving the cleaned file. WordPress refuses these file types by default because it can't vouch for their safety; this module restores them deliberately, one at a time.
WordPress refuses file types sites legitimately need
Because WordPress can't vouch for a file type's safety, it simply refuses several formats sites use every day.
SVG is a document, not an image
SVG files are XML documents that can carry scripts, which is exactly why WordPress refuses them outright rather than trying to sanitize them itself.
Modern formats get the same blanket refusal
AVIF, HEIC photos straight from an iPhone, WOFF web fonts and OBJ 3D models are all common, legitimate file types that WordPress's default allowlist simply doesn't include.
Every format, enabled deliberately
The module unlocks exactly the file types a site chooses, with SVG sanitized specifically because it's the one format that actually needs it.
SVG, sanitized rather than simply trusted
The sanitizer parses and strips every uploaded SVG of scripts, event handlers and unsafe references before WordPress ever stores it.
Modern image and font formats, unlocked
AVIF, HEIC and WOFF web fonts become available in the media library, each behind its own switch.
3D models, supported too
A site can upload OBJ files directly to the media library, for sites that need to manage 3D assets alongside their usual media.
Five formats, each its own decision
Every capability below is present in the supplied PHP class and its settings registration.
Enabled and sanitized together
Enabling SVG both allows the upload and activates the sanitization pipeline; there's no way to have one without the other.
A next-generation image format
Adds image/avif to the allowed upload types, for a format that typically compresses better than JPEG or WebP at comparable quality.
Native iPhone and Mac photo format
Adds both the heic and heif extensions together as one switch, covering photos straight from iOS and macOS cameras.
Web font uploads
Adding both font formats together lets custom web fonts go straight into the media library.
3D model uploads
Adding the model/obj MIME type lets .obj files sit and get managed like any other media attachment.
Each format can be limited to specific roles
An administrator can optionally restrict any file type to specific user roles; with no roles configured, any user who can upload media can use it.
Where unlocking formats helps most
The module supports any site whose content genuinely relies on a format WordPress blocks by default.
Design and branding assets
Upload logos, icons and illustrations as SVG directly into the media library, sanitized automatically on the way in.
Sites accepting photos straight from iPhones
Support HEIC uploads without asking contributors to convert their photos first.
Custom typography
Upload WOFF and WOFF2 web font files directly to the media library instead of managing them outside WordPress.
Real formats, real sanitization
The module combines genuine format support with a security approach built specifically around SVG's actual risk.
Filters run only when a format is on
The verified implementation adds no overhead for formats that stay disabled.
Filters only run for enabled types
If no file type is enabled, the module never registers any of the upload filters, so there's zero overhead by default.
SVG sanitization runs once, at upload
The XML parsing and cleanup happen a single time when the file arrives, not on every subsequent page load.
AVIF compresses well, reducing stored file size
Where AVIF genuinely replaces a larger format, the media library ends up storing smaller files for comparable quality.
A whitelist sanitizer, built specifically for SVG's risk
Every layer of the SVG sanitizer addresses a specific, documented attack vector.
A whitelist, not a blacklist, for SVG elements
The sanitizer checks every SVG element against an explicit list of safe tags and removes anything not on that list, so unknown or newly discovered risky elements stay blocked by default rather than requiring an update to catch them.
Every event handler attribute stripped
The sanitizer removes attributes like onclick and onload, the classic vectors for SVG-based script execution, from every uploaded file without exception.
href-like attributes locked down
Only fragment references and embedded image data survive sanitization, since the sanitizer strips external URLs and javascript: URIs from href-like attributes.
SVGZ stays blocked, deliberately
Since gzip-compressed SVG can't undergo the same inspection a plain-text SVG can, it stays refused even when regular SVG is on.
Built around native WordPress upload and XML APIs
The supplied code integrates through APIs present in WordPress core and PHP itself; this page makes no compatibility claim beyond the verified implementation.
upload_mimes
The standard WordPress filter for adding MIME types to the list of files an upload accepts.
wp_check_filetype_and_ext
The filter WordPress uses to confirm a file's real type, corrected here for formats PHP's own detection can miss.
DOMDocument with LIBXML_NONET
SVG sanitization uses PHP's own XML parser with network access explicitly disabled during parsing, closing off a class of XML-based attacks.
TheOneWP versus common alternatives
Compare the verified File Upload Types implementation with a typical single-purpose "allow SVG" snippet.
| Capability | TheOneWP File Upload Types | Other common solutions |
|---|---|---|
| Enabling blocked formats | Five formats, each an independent switch | Often a single all-or-nothing "allow SVG" snippet |
| SVG sanitization | A whitelist-based DOM sanitizer built in | Frequently absent, leaving SVG uploads unsanitized |
| Per-role restriction | Available for every file type individually | Rarely offered at this granularity |
| SVGZ handling | Deliberately excluded, since it can't be sanitized | Often overlooked entirely |
| Administration | One settings screen, five clear switches | Usually a mix of separate plugins per format |
Unlock formats in four steps
Enable only what the site actually needs, and confirm each format uploads and previews correctly.
Enable File Upload Types
Activate the module from the TheOneWP Content settings tab.
Turn on the specific formats needed
Switch on SVG, AVIF, HEIC, WOFF or OBJ individually, based on what the site actually uploads.
Restrict sensitive formats to specific roles, if needed
Limit a format like SVG to trusted roles when broader upload access isn't appropriate.
Test an upload of each enabled type
Confirm the format uploads correctly and, for SVG, that the sanitized file still displays as expected.
Enable deliberately, restrict where it matters
Each format is its own decision, and a little care around roles keeps that decision meaningful.
Enable only the formats actually in use
Each format works as its own switch for a reason; turning on everything at once widens the upload surface without a corresponding benefit.
Restrict SVG uploads to trusted roles
Even with sanitization in place, limiting who can upload SVG keeps the format's use intentional.
Check HEIC thumbnail generation on the server
HEIC preview generation needs server-side HEIF support, so confirm thumbnails render correctly after enabling it.
Remember SVGZ stays blocked
A gzip-compressed SVG needs conversion to plain SVG first, since the compressed form can't undergo sanitization.
Avoid assumptions that weaken the setup
A couple of details are easy to overlook when enabling these formats for the first time.
Assuming SVG uploads are unsafe without checking
Every SVG goes through whitelist-based sanitization before storage, not just a permission check.
Uploading a gzip-compressed SVGZ file
The module keeps SVGZ blocked even after you turn on SVG, since the compressed format can't undergo the same inspection.
Forgetting to restrict a sensitive format by role
Without a role restriction configured, any user who can upload media can use every enabled file type.
File Upload Types FAQ
These answers come directly from the verified class and its settings registration.
What does File Upload Types do?
It lets an administrator enable SVG, AVIF, HEIC, WOFF web fonts and OBJ 3D model uploads individually, sanitizing every SVG on the way in.
Why does WordPress block SVG uploads by default?
Because an SVG is an XML document that can carry scripts, unlike a typical image file, WordPress refuses it outright rather than trying to sanitize it itself.
Is SVG upload actually safe with this module enabled?
Before storage, the sanitizer parses and strips every SVG of any element or attribute not on an explicit safe list, closing off the main risk SVG uploads carry.
Can I upload gzip-compressed SVGZ files?
No. The module keeps SVGZ blocked even after you turn on SVG, since the compressed format can't undergo the same sanitization.
Do I need to enable every file type at once?
No. Each of the five formats works as its own independent switch.
Can I limit who uploads a specific file type?
Yes. An administrator can restrict any file type to specific user roles; without a restriction, any user who can upload media can use it.
Does HEIC upload guarantee a working thumbnail?
Thumbnail generation for HEIC requires server-side HEIF support; without it, the file uploads but its preview may not render.
What happens to the MIME type WordPress detects for these files?
The module corrects WordPress's own file type detection for these formats, since PHP doesn't always identify them correctly on its own.
Does enabling AVIF or HEIC add any file conversion?
No. The module only permits the upload and corrects type detection; it never converts files to or from any format.
Who can configure which file types are allowed?
Only an administrator with access to the TheOneWP settings screen.
Stop working around WordPress's default upload restrictions.Enable exactly the formats this site needs.
Use File Upload Types to unlock SVG, AVIF, HEIC, WOFF and OBJ uploads, with every SVG sanitized automatically.