Do not enable unrestricted uploads
A common workaround adds ALLOW_UNFILTERED_UPLOADS to wp-config.php. Do not use it: it can permit PHP and other executable files, creating a serious security risk.
Identify the file
Confirm its extension and real format
- Check the full filename and extension, such as .jpg, .webp, .pdf or .docx.
- Open the file in the application that created it and use Export or Save As to create a standard web format.
- Do not just rename the extension. A renamed file still contains its original data and WordPress checks the real MIME type.
- Try uploading the newly exported file in Media > Add New.
Common explanations
Match the symptom to the cause
- Unusual image format
- Export it as JPEG, PNG or WebP rather than weakening upload security.
- Filename and content disagree
- Re-export the original; changing .heic or another extension to .jpg does not convert it.
- User permission
- Confirm the account can upload media and is using the intended WordPress site.
- WordPress Multisite
- A network administrator may need to allow the safe extension in Network Settings.
- Different error about size
- Check the Media upload limit and PHP limits instead; that is not a file-type problem.
- Security plugin block
- Read its event or audit log before changing settings, then allow only the specific safe requirement.
Legitimate custom formats
Whitelist only the required safe type
If the site genuinely needs a format WordPress does not allow by default, ask a developer to add the single extension and correct MIME type using WordPress’s upload_mimes filter. If WordPress misidentifies the real content, the developer may also need the narrowly scoped wp_check_filetype_and_ext filter.
- Use a small site plugin or maintained purpose-built plugin, not a theme file that disappears on theme change.
- Restrict the change to the exact extension and expected MIME type.
- Test in staging and upload a known-good sample before using it on the live site.
- Keep WordPress, plugins and the filtering code maintained.
Never allow executable files through Media
Do not add PHP, PHTML, PHAR or similar executable formats. Treat SVG as active content: use a maintained sanitising solution and a controlled workflow rather than allowing arbitrary SVG uploads.
After the fix
Verify the upload safely
- The intended file uploads and opens correctly.
- A deliberately disallowed executable file remains blocked.
- No unrestricted-upload constant or temporary bypass remains.
- The change survives an update without being placed in WordPress core.
Still unable to upload the file?
Send the exact error, filename and extension, the application that created it, WordPress and PHP versions, your WordPress role and whether the site is Multisite. Do not attach confidential files or send passwords.
Ask the WordPress team