How to Fix "File Type Not Permitted for Security Reasons" in WordPress

Understanding the "File Type Not Supported for Security Reasons" Error

When uploading files in the WordPress admin area, you may encounter the error: "Sorry, this file type is not permitted for security reasons." This occurs because WordPress, by default, restricts the upload of certain file types to protect your site.

Root Cause

WordPress maintains a built-in list of allowed file types. Common formats like images (.jpg, .png, .gif) and documents (.pdf, .docx) are included. If the file extension or MIME type you're trying to upload isn't on this list, the security error is triggered.

Note: The error typically appears for uncommon file types like specific archives, executables, or server scripts. Common formats like .jpg are fully supported by WordPress core.

Solutions

You have two main approaches: removing all restrictions (not recommended) or safely adding specific file types.

Method 1: Remove All Upload Restrictions (Not Recommended)

Add the following line to your site's wp-config.php file:

define('ALLOW_UNFILTERED_UPLOADS', true);

Critical Warning: This allows any file type, including potentially malicious scripts (.php, .js). It significantly increases security risk and is only advised in fully trusted, controlled environments. Not recommended for most sites.

Method 2: Safely Add Allowed File Types (Recommended)

Use the upload_mimes filter in your theme's functions.php file or a custom plugin. This is the standard, secure method.

Example to allow uploading .svg files:

// Add to theme's functions.php or a custom plugin
function my_custom_upload_mimes($existing_mimes) {
    // Add .svg file type
    $existing_mimes['svg'] = 'image/svg+xml';
    // Add other types if needed, e.g.:
    // $existing_mimes['key'] = 'application/vnd.apple.keynote';
    return $existing_mimes;
}
add_filter('upload_mimes', 'my_custom_upload_mimes');

After adding the code, save the file and try uploading the previously blocked file type again.

Troubleshooting Steps

If Method 2 doesn't work, follow these steps:

1. Verify File Type: Ensure the file extension matches its actual MIME type. A mismatched extension can cause the error.
2. Check for Plugin Conflicts: Deactivate all plugins and try uploading. If successful, reactivate plugins one by one to identify the culprit.
3. Check Server Restrictions: Your server (e.g., Nginx) or security software (e.g., ModSecurity) may have its own upload rules. Contact your hosting provider.
4. Check File Size: While the error message differs, also confirm the file doesn't exceed upload_max_filesize or post_max_size limits (check under Tools > Site Health > Info > Media in WordPress admin).

Summary

When facing the "file type not permitted for security reasons" error, always prefer Method 2: safely extending the allowed file list via code. Avoid using ALLOW_UNFILTERED_UPLOADS unless absolutely necessary. Always prioritize your site's security.