You uploaded an SVG icon to your site, and WordPress silently refuses to accept it. Sound familiar? By default, the engine blocks .svg files for security reasons, and attempting to upload a logo to the media library results in the error "Sorry, this file type is not permitted."

The problem is not a faulty installation or file permissions. WordPress deliberately excludes SVG from the whitelist because the XML structure of the file can carry malicious code. But you do not have to give up vector graphics: below are three safe ways to upload SVG without risking your site.

💡 Quick overview:

• Learn what SVG is and why WordPress blocks it
• Choose one of three safe plugins for uploading
• Configure the plugin for your needs in a couple of minutes
• Compare features and get a final recommendation

What SVG is and how it differs from JPEG and PNG

SVG (Scalable Vector Graphics) is a vector format based on XML. Unlike raster JPEG and PNG, which consist of pixels, SVG describes images mathematically using lines, curves, and shapes. The result is an image that stays sharp on a 4K screen or on an advertising banner the size of a wall.

For a site owner, this means three things. First, your logo and icons look equally crisp on any device, from a phone to a desktop monitor. Second, an .svg file weighs several times less than its PNG equivalent: a typical icon takes 1-3 KB instead of 15-30 KB. Third, SVG can be animated via CSS and JavaScript without third-party libraries.

But there is a downside. The XML structure is read by the browser as code, and an attacker can embed a script in the file. This is exactly why WordPress does not include SVG in the list of allowed formats out of the box. When you try to upload one, you see that same error from the screenshot above.

SVG security: what you need to know before uploading

An .svg file is a text document with tags like <svg>, <path>, and <circle>. The browser parses it almost like HTML. If a <script> tag or an onload handler is hidden inside the file, the browser will execute that code. This is called stored XSS: a malicious script is stored on the server and fires every time a visitor opens the page.

In practice, no mass attacks via SVG on WordPress have been recorded; the vulnerability is known, and developers learned long ago how to close it. Modern SVG plugins pass the uploaded file through a sanitizer: a library that strips out all dangerous tags and attributes, leaving only "clean" graphics.

The rule is simple: never upload SVG from untrusted sources. If the file was made by your designer or downloaded from an official icon site, risks are minimal. If the file came from an unknown client via email, first open it in a text editor and make sure there are no <script> tags or on* attributes inside.

Below are three plugins that solve the SVG upload problem with different levels of control and settings.

Method 1: SVG Support, maximum capabilities

SVG Support is the most popular plugin for uploading vector graphics to WordPress. Over 1 million active installations, a 4.5 rating on WordPress.org, and consistent updates (latest in May 2026) speak for themselves.

Installation is standard: Plugins → Add New, type "SVG Support" in the search bar, click Install Now, then Activate. After activation, go to Settings → SVG Support.

The main setting you should enable right away is Restrict to Administrators. It prevents anyone except administrators from uploading SVG. If you are the only one managing the site, this checkbox protects against accidental upload of a dangerous file by an editor or SEO specialist.

Advanced Mode enables CSS animation and inline rendering of SVG. You need this if you plan to animate icons or change their color via theme styles. Without this checkbox, the plugin automatically strips potentially dangerous attributes, and animation may break.

SVG Support also knows how to wrap uploaded files in an <img> tag with correct dimensions; this matters for Core Web Vitals because the browser reserves space for the image before it loads and the page does not "jump."

• Pros: fine-grained access control, advanced mode for animations, automatic image sizing, regular updates
• Cons: settings available only in a separate tab (no integration with the media library)
• Price: free
• Download: 🔗 SVG Support on WordPress.org

Method 2: Safe SVG, minimalism from the 10up team

Safe SVG is developed by the agency 10up; these are the folks trusted by Microsoft, Adobe, and The White House. And that is the best recommendation a security plugin can have.

Unlike SVG Support, Safe SVG requires no configuration. Install, activate, and you are done; you can start uploading SVG. The plugin uses the same sanitization library as the WordPress core (enshrined/svg-sanitize) and passes every file through it at upload time. No extra interfaces, no settings; it just works.

Safe SVG allows SVG uploads for all users who have the upload_files capability. If your site has multiple authors, you should additionally restrict the group, for example via a role management plugin. But for a solo administrator, this is the simplest and safest path.

The plugin has been around for years, has over 1 million active installations, and a 4.4 rating. It is updated less frequently than SVG Support (latest in April 2026), but that is actually a sign of stability: there is nothing to break.

• Pros: no configuration needed, works out of the box, sanitization at WordPress core level, developer with an impeccable reputation
• Cons: no access control settings, no advanced mode for animations, no inline rendering
• Price: free
• Download: 🔗 Safe SVG on WordPress.org

Method 3: WP SVG Images, sanitization with role control

WP SVG Images is developed by the ShortPixel team, known for their image optimization tools. The plugin occupies a middle ground between SVG Support and Safe SVG: role settings are present, but there are no unnecessary screens.

After activation, the plugin immediately allows SVG uploads for all administrators and editors. In Settings → WP SVG Images, you can fine-tune which roles are allowed to upload and enable sanitization individually for each role. For example: admins upload without checks, editors upload with mandatory sanitization, authors cannot upload at all.

An additional plus is SVG preview right in the media library. Standard WordPress shows a placeholder icon instead of the vector file. WP SVG Images renders a thumbnail, so you see exactly what you uploaded without opening the file in a new tab.

The plugin also provides filters for developers: WPSVG_setAllowedTags and WPSVG_setAllowedAttrs let you add custom tags and attributes to the sanitizer whitelist.

• Pros: SVG preview in the media library, flexible sanitization settings by role, filters for developers, active support
• Cons: no advanced animation mode, requires PHP 5.6.40+
• Price: free
• Download: 🔗 WP SVG Images on WordPress.org

Comparison table: which plugin to choose

All three plugins are free and use proven sanitization libraries. SVG Support is the choice for those who need animation and maximum control. Safe SVG is for those who value simplicity and do not want to touch settings. WP SVG Images is a compromise with a convenient preview and flexible permission distribution.

How to install an SVG plugin and upload a file: step by step

Regardless of which plugin you choose, the installation process is the same:

Step 1. In the WordPress admin panel, open Plugins → Add New.

Step 2. In the search bar, enter the plugin name: SVG Support, Safe SVG, or WP SVG Images.

Step 3. Click Install Now on the card of the desired plugin, then Activate.

Step 4. If the plugin has settings (SVG Support or WP SVG Images), go to the corresponding tab and enable role restrictions. For Safe SVG, this step is not needed.

Step 5. Open the post or page editor. In the Image block, click "Upload"; the .svg format is now on the whitelist.

Before uploading an SVG file, make sure you trust its source. Ideally, use files created by your designer in Illustrator, Figma, or Inkscape. If you received an SVG from a third-party contractor, open it in Notepad and quickly scan it: there should be no <script> or onload= inside.

In practice, a three-second manual check plus the plugin sanitizer provide double the security margin. Over years of working with WordPress, we have not encountered a single real incident with SVG uploaded through any of the three plugins described.

If you prefer video format, the clip above shows the entire process from plugin installation to inserting SVG on a page.

⁉️🤔 Frequently asked questions

Can I upload SVG without a plugin?

Add a snippet with the upload_mimes filter that registers the MIME type image/svg+xml. However, we do not recommend this approach: without a sanitizer, you expose your site to stored XSS. A plugin solves the security problem automatically; a couple of clicks versus a potential hole in your defenses.

Why is the Enable SVG plugin no longer available?

Reason: "Author Request." The plugin was not updated for 4 years and has been permanently removed from WordPress.org. If you have it installed, replace it with one of the three plugins above. They are actively maintained and compatible with WordPress 7.0.

How do I verify that an uploaded SVG is safe?

A safe SVG consists of graphical primitives like svg, g, and path inside. No script, no foreignObject, and no onload or onclick attributes appear in a clean file. All three plugins in this article automatically strip dangerous elements during upload.

Which format is better for a logo, SVG or PNG?

SVG is the right choice for most sites. A vector logo takes just a few kilobytes, does not blur on retina screens, and can change color via CSS. PNG is needed only if the logo contains a photograph or a complex gradient that renders poorly in vector.

WP SVG Images or Safe SVG: which is more reliable?

The difference is in convenience. Safe SVG is "set and forget" from an elite agency. WP SVG Images gives you previews in the media library and individual role settings. In terms of security, they are equivalent.

Conclusion: what to install in 2026

All three plugins solve the task of safe SVG uploads; the choice comes down to your use case.

Need animation of vector icons and inline rendering? Go with SVG Support; it is the only plugin with advanced mode.

Just want to upload a logo and forget about the problem? Safe SVG is your option. Install, activate, done.

Need media library previews and fine-grained access control for your team? Choose WP SVG Images; ShortPixel made a convenient tool with the best rating among SVG plugins.

In short: install Safe SVG for minimalism or SVG Support for full control. Both options are free and tested on millions of sites. And most importantly, after installing any of the three plugins, the "file type not permitted" error goes away for good.