{"id":1527,"date":"2026-10-28T22:36:58","date_gmt":"2026-10-28T22:36:58","guid":{"rendered":"https:\/\/www.ahosting.net\/blog\/?p=1527"},"modified":"2026-10-28T22:36:59","modified_gmt":"2026-10-28T22:36:59","slug":"sorry-this-file-type-is-not-permitted-for-security-reasons","status":"publish","type":"post","link":"https:\/\/www.ahosting.net\/blog\/sorry-this-file-type-is-not-permitted-for-security-reasons\/","title":{"rendered":"Sorry, This File Type Is Not Permitted for Security Reasons: What WordPress Checks and How to Fix It"},"content":{"rendered":"\n<script type=\"application\/ld+json\">{\"@context\": \"https:\/\/schema.org\", \"@type\": \"FAQPage\", \"mainEntity\": [{\"@type\": \"Question\", \"name\": \"Why does WordPress keep saying the file type is not permitted in 2026?\", \"acceptedAnswer\": {\"@type\": \"Answer\", \"text\": \"Specifically, WordPress compared your file with its list of allowed types and found no match. The comparison looks at the extension, at the real content of the file and at your user capabilities. SVG, JSON and font files fail the first check on every default install.\"}}, {\"@type\": \"Question\", \"name\": \"How do I fix the file type is not permitted error for SVG files in WordPress 2026?\", \"acceptedAnswer\": {\"@type\": \"Answer\", \"text\": \"In practice, add the SVG type to the upload_mimes filter in a small plugin, then upload again. In our lab on WordPress 7.1.4 that one filter let SVG, JSON and WOFF2 files through. Remember that an SVG is a text document that can carry script, so allow it only for people you trust.\"}}, {\"@type\": \"Question\", \"name\": \"Is the file type is not permitted message vs not allowed to upload this file type the same error?\", \"acceptedAnswer\": {\"@type\": \"Answer\", \"text\": \"Indeed, they are the same check with different wording. WordPress 5.2 printed the first sentence and WordPress 5.9 and later print the second at the same place in the upload code. The cause and the fixes are identical, so use whichever text you see.\"}}, {\"@type\": \"Question\", \"name\": \"Why is the file type is not permitted even when I am logged in as an administrator?\", \"acceptedAnswer\": {\"@type\": \"Answer\", \"text\": \"Typically, the administrator role does not skip the check on a default install. The skip needs the unfiltered upload capability, and WordPress grants it only when a constant in wp-config.php switches it on. In our lab an administrator was refused SVG, JSON, PHP and font files.\"}}, {\"@type\": \"Question\", \"name\": \"Is ALLOW_UNFILTERED_UPLOADS vs the upload_mimes filter the safer fix when the file type is not permitted?\", \"acceptedAnswer\": {\"@type\": \"Answer\", \"text\": \"Overall, the filter is the safer fix. It opens one named type and every other check still runs. The constant removes the check for every user who holds the capability, and in our lab it accepted a text file named as a JPEG and a PHP file.\"}}, {\"@type\": \"Question\", \"name\": \"Why does WordPress say the file type is not permitted for a text file I renamed to .jpg?\", \"acceptedAnswer\": {\"@type\": \"Answer\", \"text\": \"In fact, WordPress reads the file content as well as its name. The content check reported plain text, which does not match the JPEG type that the extension claims, so the upload was refused. Save a real image in the format you need rather than renaming one.\"}}, {\"@type\": \"Question\", \"name\": \"Can AHosting support tell me why the file type is not permitted on my WordPress upload?\", \"acceptedAnswer\": {\"@type\": \"Answer\", \"text\": \"Specifically, open a ticket with the exact message, the file name and extension, and what happened when you tried a small real image. That tells us whether this is the allowed-type list, a content mismatch or something on the server, so the first reply can be specific.\"}}, {\"@type\": \"Question\", \"name\": \"Should I ask AHosting to change a server setting when the file type is not permitted?\", \"acceptedAnswer\": {\"@type\": \"Answer\", \"text\": \"Typically, no. In our lab the message came from WordPress core code, which ships with WordPress itself. Ask us only if a plain JPEG is refused, if the message differs from the two WordPress sentences, or if a security rule blocks the request before WordPress runs.\"}}, {\"@type\": \"Question\", \"name\": \"Will the file type is not permitted error go away after I update WordPress in 2026?\", \"acceptedAnswer\": {\"@type\": \"Answer\", \"text\": \"Overall, an update will not add SVG, JSON or font types to the allowed list. WordPress 7.1.4 still has no entry for them, and the message wording only changed between the 5.2 and 5.9 releases. Keep the site current, then handle the type with the filter.\"}}, {\"@type\": \"Question\", \"name\": \"On AHosting WordPress hosting, is zipping a blocked file better vs converting it when the file type is not permitted?\", \"acceptedAnswer\": {\"@type\": \"Answer\", \"text\": \"Ultimately, converting is the cleaner choice when a standard format exists, such as a PNG or JPEG. WordPress lists ZIP as an allowed type in its source, and we did not upload a ZIP in our lab. A zip hides the file inside a download, so readers cannot see it on the page.\"}}]}<\/script>\n\n\n<div class=\"wp-block-aioseo-table-of-contents\"><ul><li><a class=\"aioseo-toc-item\" href=\"#file-type-is-not-permitted-what-it-means\">Sorry, This File Type Is Not Permitted for Security Reasons: What WordPress Is Telling You<\/a><\/li><li><a class=\"aioseo-toc-item\" href=\"#file-type-is-not-permitted-two-messages\">Why the File Type Is Not Permitted Message Reads Two Ways<\/a><\/li><li><a class=\"aioseo-toc-item\" href=\"#three-checks-file-type-is-not-permitted\">The Three Checks<\/a><\/li><li><a class=\"aioseo-toc-item\" href=\"#files-the-file-type-is-not-permitted-by-default\">Files Where the File Type Is Not Permitted by Default<\/a><\/li><li><a class=\"aioseo-toc-item\" href=\"#file-type-is-not-permitted-content-mismatch\">When the File Type Is Not Permitted Because the Content Does Not Match<\/a><\/li><li><a class=\"aioseo-toc-item\" href=\"#who-can-skip-the-upload-check\">Who Can Skip the Check: Administrators Are Not Exempt<\/a><\/li><li><a class=\"aioseo-toc-item\" href=\"#fix-file-type-is-not-permitted-upload-mimes\">Fixing the Error for One Type with upload_mimes<\/a><\/li><li><a class=\"aioseo-toc-item\" href=\"#why-allow-unfiltered-uploads-is-the-wrong-fix\">Why ALLOW_UNFILTERED_UPLOADS Is the Wrong Fix<\/a><\/li><li><a class=\"aioseo-toc-item\" href=\"#file-type-is-not-permitted-fileinfo\">When a Server Is the Cause: What the fileinfo Extension Changes<\/a><\/li><li><a class=\"aioseo-toc-item\" href=\"#file-type-is-not-permitted-decoder-table\">The File Type Is Not Permitted Decoder Table<\/a><\/li><li><a class=\"aioseo-toc-item\" href=\"#find-why-file-type-is-not-permitted\">Try the File Type Finder<\/a><\/li><li><a class=\"aioseo-toc-item\" href=\"#what-ahosting-can-do-file-type-is-not-permitted\">What Can AHosting Do?<\/a><\/li><li><a class=\"aioseo-toc-item\" href=\"#faq-sorry-this-file-type-is-not-permitted-for-security-reasons\">Frequently Asked Questions: File Type Is Not Permitted<\/a><ul><li><a class=\"aioseo-toc-item\" href=\"#faq-why-file-type-is-not-permitted-2026\">Why does WordPress keep saying the file type is not permitted in 2026?<\/a><\/li><li><a class=\"aioseo-toc-item\" href=\"#faq-fix-svg-file-type-is-not-permitted-2026\">How do I fix the file type is not permitted error for SVG files in WordPress 2026?<\/a><\/li><li><a class=\"aioseo-toc-item\" href=\"#faq-file-type-is-not-permitted-vs-not-allowed\">Is the file type is not permitted message vs not allowed to upload this file type the same error?<\/a><\/li><li><a class=\"aioseo-toc-item\" href=\"#faq-admin-file-type-is-not-permitted\">Why is the file type is not permitted even when I am logged in as an administrator?<\/a><\/li><li><a class=\"aioseo-toc-item\" href=\"#faq-allow-unfiltered-uploads-vs-upload-mimes\">Is ALLOW_UNFILTERED_UPLOADS vs the upload_mimes filter the safer fix when the file type is not permitted?<\/a><\/li><li><a class=\"aioseo-toc-item\" href=\"#faq-renamed-file-type-is-not-permitted\">Why does WordPress say the file type is not permitted for a text file I renamed to .jpg?<\/a><\/li><li><a class=\"aioseo-toc-item\" href=\"#faq-ahosting-support-file-type-is-not-permitted\">Can AHosting support tell me why the file type is not permitted on my WordPress upload?<\/a><\/li><li><a class=\"aioseo-toc-item\" href=\"#faq-ahosting-server-setting-file-type-is-not-permitted\">Should I ask AHosting to change a server setting when the file type is not permitted?<\/a><\/li><li><a class=\"aioseo-toc-item\" href=\"#faq-update-file-type-is-not-permitted-2026\">Will the file type is not permitted error go away after I update WordPress in 2026?<\/a><\/li><li><a class=\"aioseo-toc-item\" href=\"#faq-ahosting-zip-vs-convert-file-type-is-not-permitted\">On AHosting WordPress hosting, is zipping a blocked file better vs converting it when the file type is not permitted?<\/a><\/li><\/ul><\/li><\/ul><\/div>\n\n\n<div class=\"ah-tldr\">\n  <span class=\"ah-tldr-badge\">TL;DR<\/span>\n  <p>WordPress refuses an upload when the extension is not on its allowed list, when the real content of the file does not match the extension, or when neither check passes and your account lacks the unfiltered upload capability. SVG, JSON and font files fail the first check on a default install. In a WordPress 7.1.4 lab, an administrator was refused all three, a text file renamed to .jpg was refused, and one upload_mimes filter let the first three types through.<\/p>\n<\/div>\n\n\n\n<h2 id=\"file-type-is-not-permitted-what-it-means\" class=\"wp-block-heading\">Sorry, This File Type Is Not Permitted for Security Reasons: What WordPress Is Telling You<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">You pick a file in the Media Library and WordPress answers that the file type is not permitted for security reasons. The text comes from the WordPress upload code itself: WordPress ran a short list of checks on the upload, and your file failed one of them. This guide walks through the three checks, shows which files fail them on a default install, and gives the smallest safe fix for each case.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">We tested every claim here on a real WordPress 7.1.4 install with PHP 8.5.10 and read the matching lines of core code. It was a workstation lab, not an AHosting server, so where a result depends on server software we say so.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Short version: the message names the file type, but the file type is only the symptom. Three different problems produce the same sentence, and each has a different fix, so the first job is to tell them apart.<\/p>\n\n\n\n<h2 id=\"file-type-is-not-permitted-two-messages\" class=\"wp-block-heading\">Why the File Type Is Not Permitted Message Reads Two Ways<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Search results mix two sentences, and they come from different WordPress releases. Reading the upload code for each release, we found the old sentence, &#8220;Sorry, this file type is not permitted for security reasons.&#8221;, in version 4.9 and in version 5.2, at <a href=\"https:\/\/github.com\/WordPress\/WordPress\/blob\/5.2\/wp-admin\/includes\/file.php\" target=\"_blank\" rel=\"noopener\">wp-admin\/includes\/file.php in the 5.2 tag<\/a>. In the 5.9 tag, and in every tag we checked up to 7.0, the same place prints &#8220;Sorry, you are not allowed to upload this file type.&#8221; We checked tags rather than release notes, so we cannot name the exact release that changed the wording.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">The conditions around the sentence did not change in a way that matters to you. On current WordPress the line is <code>wp-admin\/includes\/file.php<\/code> line 972, and it fires when the type or the extension came back empty and your account lacks one capability. Older sites, plugins that print their own text and forum posts still use the first sentence, which is why it keeps its search volume.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Two neighbors look similar but are different faults. An empty file produces a separate message about the file being empty. A server that cannot store the upload gives the different errors in our guides to <a href=\"https:\/\/www.ahosting.net\/blog\/missing-a-temporary-folder\/\">the missing temporary folder error<\/a> and <a href=\"https:\/\/www.ahosting.net\/blog\/wordpress-413-request-entity-too-large\/\">the 413 request entity too large error<\/a>. A similar-sounding permissions message, covered in our guide to <a href=\"https:\/\/www.ahosting.net\/blog\/sorry-you-are-not-allowed-to-access-this-page-wordpress\/\">the not allowed to access this page error<\/a>, is a different fault. If your message is neither of the two sentences above, you are on the wrong page.<\/p>\n\n\n\n<h2 id=\"three-checks-file-type-is-not-permitted\" class=\"wp-block-heading\">The Three Checks<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Every upload through the Media Library passes through one function, <code>wp_check_filetype_and_ext()<\/code>, which the <a href=\"https:\/\/developer.wordpress.org\/reference\/functions\/wp_check_filetype_and_ext\/\" target=\"_blank\" rel=\"noopener\">WordPress developer reference<\/a> describes. It runs the file through three checks in a fixed order.<\/p>\n\n\n\n<ol class=\"wp-block-list\">\n<li><strong>The extension.<\/strong> WordPress matches the end of the file name against its allowed list. The matching code, <code>wp_check_filetype()<\/code>, looks only at the name. If nothing matches, there is no type.<\/li>\n\n\n\n<li><strong>The real content.<\/strong> If the PHP fileinfo extension is loaded, WordPress asks it what the file actually contains. When that answer differs from the type the extension claims, WordPress treats the file as dangerous and discards the type (<code>functions.php<\/code> lines 3207 to 3209 and 3310 to 3318).<\/li>\n\n\n\n<li><strong>The capability.<\/strong> Back in the upload handler, if the type or extension is still empty, the error appears unless your account holds <code>unfiltered_upload<\/code> (<code>file.php<\/code> lines 971 and 972).<\/li>\n<\/ol>\n\n\n\n<p class=\"wp-block-paragraph\">That order explains most confusion. The third check is the only one that names your account, and on a default install nobody passes it. So the extension and the content decide the result for everyone, administrators included.<\/p>\n\n\n\n<div class=\"ah-infographic\">\n  <svg viewBox=\"0 0 760 330\" xmlns=\"http:\/\/www.w3.org\/2000\/svg\" role=\"img\" aria-label=\"The three checks WordPress runs on every upload: the extension must be on the allowed list, the real content must match the extension, and the user must hold the unfiltered upload capability to skip a failed check.\">\n    <title>The three checks behind a file type is not permitted error<\/title>\n    <desc>An upload passes three checks in order. First, the file extension must appear in the allowed list built by get_allowed_mime_types. Second, the real content, read by the PHP fileinfo extension, must match the type that the extension claims. Third, if either check left no type, only a user holding the unfiltered upload capability may continue; everyone else sees the error. In the lab, administrators did not hold that capability until a constant was set.<\/desc>\n    <rect x=\"0\" y=\"0\" width=\"760\" height=\"330\" rx=\"12\" fill=\"#f8fafc\" stroke=\"#cbd5e1\"\/>\n    <text x=\"380\" y=\"34\" text-anchor=\"middle\" font-family=\"Arial, sans-serif\" font-size=\"16\" font-weight=\"700\" fill=\"#0f172a\">Three checks, and one capability that can skip them<\/text>\n    <text x=\"380\" y=\"56\" text-anchor=\"middle\" font-family=\"Arial, sans-serif\" font-size=\"12\" font-weight=\"400\" fill=\"#334155\">Lab: WordPress 7.1.4, PHP 8.5.10, 2026-10-28<\/text>\n    <rect x=\"14\" y=\"86\" width=\"226\" height=\"96\" rx=\"8\" fill=\"#ffffff\" stroke=\"#2563eb\" stroke-width=\"2\"\/>\n    <text x=\"127\" y=\"112\" text-anchor=\"middle\" font-family=\"Arial, sans-serif\" font-size=\"13\" font-weight=\"700\" fill=\"#0f172a\">1. The extension<\/text>\n    <text x=\"127\" y=\"134\" text-anchor=\"middle\" font-family=\"Arial, sans-serif\" font-size=\"12\" font-weight=\"400\" fill=\"#334155\">Is .svg, .json or .woff2<\/text>\n    <text x=\"127\" y=\"152\" text-anchor=\"middle\" font-family=\"Arial, sans-serif\" font-size=\"12\" font-weight=\"400\" fill=\"#334155\">on the allowed list?<\/text>\n    <text x=\"127\" y=\"172\" text-anchor=\"middle\" font-family=\"Arial, sans-serif\" font-size=\"11\" font-weight=\"700\" fill=\"#7f1d1d\">Default list: no<\/text>\n    <rect x=\"267\" y=\"86\" width=\"226\" height=\"96\" rx=\"8\" fill=\"#ffffff\" stroke=\"#2563eb\" stroke-width=\"2\"\/>\n    <text x=\"380\" y=\"112\" text-anchor=\"middle\" font-family=\"Arial, sans-serif\" font-size=\"13\" font-weight=\"700\" fill=\"#0f172a\">2. The real content<\/text>\n    <text x=\"380\" y=\"134\" text-anchor=\"middle\" font-family=\"Arial, sans-serif\" font-size=\"12\" font-weight=\"400\" fill=\"#334155\">Does fileinfo read the same<\/text>\n    <text x=\"380\" y=\"152\" text-anchor=\"middle\" font-family=\"Arial, sans-serif\" font-size=\"12\" font-weight=\"400\" fill=\"#334155\">type the extension claims?<\/text>\n    <text x=\"380\" y=\"172\" text-anchor=\"middle\" font-family=\"Arial, sans-serif\" font-size=\"11\" font-weight=\"700\" fill=\"#7f1d1d\">Text named .jpg: no<\/text>\n    <rect x=\"520\" y=\"86\" width=\"226\" height=\"96\" rx=\"8\" fill=\"#fef2f2\" stroke=\"#b91c1c\" stroke-width=\"2\"\/>\n    <text x=\"633\" y=\"112\" text-anchor=\"middle\" font-family=\"Arial, sans-serif\" font-size=\"13\" font-weight=\"700\" fill=\"#7f1d1d\">3. The capability<\/text>\n    <text x=\"633\" y=\"134\" text-anchor=\"middle\" font-family=\"Arial, sans-serif\" font-size=\"12\" font-weight=\"400\" fill=\"#7f1d1d\">Did a check fail and does the<\/text>\n    <text x=\"633\" y=\"152\" text-anchor=\"middle\" font-family=\"Arial, sans-serif\" font-size=\"12\" font-weight=\"400\" fill=\"#7f1d1d\">user lack unfiltered upload?<\/text>\n    <text x=\"633\" y=\"172\" text-anchor=\"middle\" font-family=\"Arial, sans-serif\" font-size=\"11\" font-weight=\"700\" fill=\"#7f1d1d\">Then the error appears<\/text>\n    <rect x=\"14\" y=\"214\" width=\"732\" height=\"70\" rx=\"8\" fill=\"#eff6ff\" stroke=\"#2563eb\" stroke-width=\"2\"\/>\n    <text x=\"380\" y=\"240\" text-anchor=\"middle\" font-family=\"Arial, sans-serif\" font-size=\"12\" font-weight=\"700\" fill=\"#0f172a\">Fixes map to the checks: add one type to the allowed list, save a real file in the right format,<\/text>\n    <text x=\"380\" y=\"260\" text-anchor=\"middle\" font-family=\"Arial, sans-serif\" font-size=\"12\" font-weight=\"700\" fill=\"#0f172a\">or (rarely, and with care) grant the capability that skips both<\/text>\n    <text x=\"380\" y=\"316\" text-anchor=\"middle\" font-family=\"Arial, sans-serif\" font-size=\"11\" font-weight=\"400\" fill=\"#334155\">Sources: wp-admin\/includes\/file.php and wp-includes\/functions.php in WordPress 7.1.4<\/text>\n  <\/svg>\n<\/div>\n\n\n\n<p class=\"wp-block-paragraph\">Notice that the type your browser sends plays no part. In the lab we sent an SVG as <code>application\/octet-stream<\/code> and WordPress decided from the name and the content alone, and a <a href=\"https:\/\/mimesniff.spec.whatwg.org\/\" target=\"_blank\" rel=\"noopener\">browser MIME sniffing standard<\/a> describes the same idea from the browser side, weighing a supplied type against what the content shows. Changing the type in a plugin or a script therefore cannot help.<\/p>\n\n\n\n<h2 id=\"files-the-file-type-is-not-permitted-by-default\" class=\"wp-block-heading\">Files Where the File Type Is Not Permitted by Default<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">The allowed list is built by <code>get_allowed_mime_types()<\/code> from a table in <code>wp_get_mime_types()<\/code>. We read that table in WordPress 7.1.4. It has entries for JPEG, PNG, GIF, WebP, AVIF, HEIC, PDF, ZIP, CSV, text and common office files. It has no entry for SVG, JSON, WOFF, WOFF2, TTF or OTF. The function also removes SWF and EXE for everyone, and removes HTML and JS for any account without the <code>unfiltered_html<\/code> capability.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">The table shows what we saw when we uploaded each file as an administrator on a single site through the same endpoint the Media Library uses.<\/p>\n\n\n\n<figure class=\"wp-block-table ah-ladder\"><table><thead><tr><th>File<\/th><th>Real type found<\/th><th>Result on a default install<\/th><\/tr><\/thead><tbody><tr><td>logo.svg<\/td><td>image\/svg+xml<\/td><td>Refused, extension not on the list<\/td><\/tr><tr><td>data.json<\/td><td>application\/json<\/td><td>Refused, extension not on the list<\/td><\/tr><tr><td>font.woff2<\/td><td>font\/woff2<\/td><td>Refused, extension not on the list<\/td><\/tr><tr><td>shell.php<\/td><td>text\/x-php<\/td><td>Refused, PHP is not on the list<\/td><\/tr><tr><td>script.js with one word<\/td><td>text\/plain<\/td><td>Refused, the content was read as plain text<\/td><\/tr><tr><td>notes.txt and data.csv<\/td><td>text\/plain<\/td><td>Accepted<\/td><\/tr><tr><td>real PNG, JPEG and HEIC images<\/td><td>image\/png, image\/jpeg, image\/heic<\/td><td>Accepted<\/td><\/tr><tr><td>empty.txt<\/td><td>application\/x-empty<\/td><td>Different message, the file is empty<\/td><\/tr><\/tbody><\/table><figcaption class=\"wp-element-caption\">AHosting WordPress Upload Check Lab Results: what an administrator could upload on a default WordPress 7.1.4 install, lab run 2026-10-28. Not an AHosting server.<\/figcaption><\/figure>\n\n\n\n<p class=\"wp-block-paragraph\">Read the first four rows as the answer to most searches. The content check found the correct real type for SVG, JSON and WOFF2, and they were still refused. Nothing is wrong with those files. Their extensions are simply not listed, so the fix is on the list rather than on the file.<\/p>\n\n\n\n<h2 id=\"file-type-is-not-permitted-content-mismatch\" class=\"wp-block-heading\">When the File Type Is Not Permitted Because the Content Does Not Match<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">The second check catches files whose name and content disagree. We made two such files. A plain text file named <code>fake.jpg<\/code> was refused, and so was a text file named <code>doc.pdf<\/code>. In both cases fileinfo reported plain text while the extension claimed an image or a PDF.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Real images with the wrong extension behaved differently, and the reason is a nice detail. For image types, WordPress runs a separate correction first. A PNG named <code>real-as.jpg<\/code> was accepted and stored with a corrected <code>.png<\/code> name, and a JPEG named <code>real-as.png<\/code> was stored as <code>.jpg<\/code>. The correction lives in the image branch of <code>wp_check_filetype_and_ext()<\/code> and sets a replacement file name. Anything that is not an image goes to the strict comparison instead.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">So a refusal of a &#8220;photo&#8221; almost always means the file is not what its name says. Export from a graphics app, a camera or a phone often leaves a file with an extension the content does not back up, for example a text error page saved as an image by a download tool. Open the file in an editor, confirm it shows a picture, then save a fresh copy as JPEG or PNG. Our plain guide to <a href=\"https:\/\/www.ahosting.net\/blog\/the-server-cannot-process-the-image\/\">the server cannot process the image error<\/a> covers the next problem you may meet after a file passes this check.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">If WordPress still refuses a file you know is a real image, send us the file name and the exact sentence. We can check how fileinfo reads it on your account, which is something a dashboard cannot show you.<\/p>\n\n\n\n<h2 id=\"who-can-skip-the-upload-check\" class=\"wp-block-heading\">Who Can Skip the Check: Administrators Are Not Exempt<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">It is easy to assume that administrators bypass upload restrictions. In the lab that was false. As a single-site administrator we were refused SVG, JSON, WOFF2, PHP and a one-word JS file. The administrator role does hold the <code>unfiltered_upload<\/code> capability, set in <code>schema.php<\/code> lines 891 to 895. The capability does not work on its own, though. <code>capabilities.php<\/code> lines 587 to 593 turn it into <code>do_not_allow<\/code> unless a constant named ALLOW_UNFILTERED_UPLOADS is defined as true, and on a multisite network only a super administrator gets it even then.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">The practical meaning is simple. On a default install the account type changes nothing. Whether you are an administrator, an editor or an author, the extension list and the content check decide. Logging in with a stronger account, or asking a client for one, is not a fix.<\/p>\n\n\n\n<h2 id=\"fix-file-type-is-not-permitted-upload-mimes\" class=\"wp-block-heading\">Fixing the Error for One Type with upload_mimes<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">When the extension is the problem, add that single type to the allowed list. WordPress built this hook for the purpose. A comment above the check in <code>file.php<\/code> line 959 says to override the list or use the upload_mimes filter, and the <a href=\"https:\/\/developer.wordpress.org\/reference\/hooks\/upload_mimes\/\" target=\"_blank\" rel=\"noopener\">filter documentation<\/a> describes the same hook. Put the code in a small plugin or a must-use plugin, not in a theme file you might switch later.<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>add_filter( 'upload_mimes', function ( $mimes ) {\n\t$mimes&#91;'svg'] = 'image\/svg+xml';\n\treturn $mimes;\n} );<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">In the lab we added SVG, JSON and WOFF2 this way. All three uploaded after the filter was active, and each was stored under its own name. The same filter left <code>fake.jpg<\/code> and <code>shell.php<\/code> refused, because it changes only the extension list and the content check still ran. That is the behavior you want from a fix.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Keep two cautions in mind. An SVG is a text document that can contain script, so allow it only for accounts you trust, and consider a plugin that cleans SVG files if visitors can upload. A font file will be served by your site, so confirm you hold the license. If a standard format exists, converting the file is simpler than changing the list.<\/p>\n\n\n\n<h2 id=\"why-allow-unfiltered-uploads-is-the-wrong-fix\" class=\"wp-block-heading\">Why ALLOW_UNFILTERED_UPLOADS Is the Wrong Fix<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">The other popular answer is to add <code>define( 'ALLOW_UNFILTERED_UPLOADS', true );<\/code> to wp-config.php. It works, and that is the problem. With the constant set, every upload we tried succeeded, including the SVG, the JSON file, a JS file, a PHP file, a text file named as a JPEG and a text file named as a PDF. The constant does not add a type. It switches the check off for everyone who holds the capability.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">We did not request the PHP file after uploading it, so we cannot say whether a server would run it. Whether it runs depends on server configuration that differs between hosts. The point stands without that test: an upload form that accepts a file because it is allowed to accept anything is a much larger opening than the one type you needed.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">One practical note from the run. The first upload attempt, made seconds after we edited wp-config.php, still failed, and the same files succeeded a few seconds later. We read that as the old configuration still being served from cache. If you add the constant, allow a moment before testing, and remove it once you are done.<\/p>\n\n\n\n<h2 id=\"file-type-is-not-permitted-fileinfo\" class=\"wp-block-heading\">When a Server Is the Cause: What the fileinfo Extension Changes<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">The content check runs only when the fileinfo extension is loaded. In <code>functions.php<\/code> line 3207 the condition reads <code>extension_loaded( 'fileinfo' )<\/code>. Without it, WordPress skips the real-content comparison and decides from the extension alone. We did not test that case, because fileinfo is part of our lab PHP, and we do not claim what any hosting server has.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">What you can check yourself is where the message comes from. It is produced by WordPress PHP code, so the request already reached WordPress. If a web firewall stopped the upload earlier, you would see a different response from the server, not either WordPress sentence. We did not test a firewall, so treat that as something to read in your own logs.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Server software can still matter through the file you send. A tool in your workflow may change how it writes a file, and fileinfo then reads the new bytes. If the same file uploads on one site and not on another, compare the real file, not the name. The <a href=\"https:\/\/www.darwinsys.com\/file\/\" target=\"_blank\" rel=\"noopener\">file command project<\/a> explains the idea behind content detection: it looks at what a file contains instead of relying on the extension.<\/p>\n\n\n\n<h2 id=\"file-type-is-not-permitted-decoder-table\" class=\"wp-block-heading\">The File Type Is Not Permitted Decoder Table<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Use this table with the file and the message in front of you. Match the symptom, then run the first check. The last column records what we saw in the lab.<\/p>\n\n\n\n<figure class=\"wp-block-table ah-ladder\"><table><thead><tr><th>Symptom<\/th><th>Likely cause<\/th><th>First check<\/th><th>Lab result<\/th><\/tr><\/thead><tbody><tr><td>SVG, JSON or font refused<\/td><td>Extension not on the list<\/td><td>Is the type in the upload_mimes filter?<\/td><td>Accepted after the filter<\/td><\/tr><tr><td>A photo refused<\/td><td>Content does not match the name<\/td><td>Does the file open as an image on your computer?<\/td><td>Text named .jpg refused<\/td><\/tr><tr><td>A real image stored with a different extension<\/td><td>None, WordPress corrected the name<\/td><td>Check the stored file name<\/td><td>PNG named .jpg stored as .png<\/td><\/tr><tr><td>PHP, JS or HTML refused<\/td><td>Not allowed or needs unfiltered HTML<\/td><td>Use FTP or a plugin for code, not Media<\/td><td>PHP and JS refused<\/td><\/tr><tr><td>Works for you, fails for a client<\/td><td>Account difference only for HTML and JS<\/td><td>Compare roles for the unfiltered HTML capability<\/td><td>Admin not exempt for the rest<\/td><\/tr><tr><td>Everything accepted, even odd files<\/td><td>ALLOW_UNFILTERED_UPLOADS is on<\/td><td>Search wp-config.php for the constant<\/td><td>All seven test files accepted<\/td><\/tr><tr><td>Message about an empty file<\/td><td>Zero bytes arrived<\/td><td>File size, then PHP upload limits<\/td><td>Different message<\/td><\/tr><\/tbody><\/table><figcaption class=\"wp-element-caption\">Match the message and the file to the cause. WordPress 7.1.4, PHP 8.5.10, lab run 2026-10-28.<\/figcaption><\/figure>\n\n\n\n<h2 id=\"find-why-file-type-is-not-permitted\" class=\"wp-block-heading\">Try the File Type Finder<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Pick the kind of file and the account you used. The tool names the likely cause and jumps to the section that fixes it.<\/p>\n\n\n\n<style>\n.ahftn-tool{border:1px solid #cbd5e1;border-radius:10px;padding:20px;margin:24px 0;background:#ffffff;color:#0f172a}\n.ahftn-tool h3{margin:0 0 12px;font-size:1.2rem;color:#0f172a}\n.ahftn-tool label{display:block;font-weight:600;margin:14px 0 6px;color:#0f172a}\n.ahftn-tool select{width:100%;max-width:560px;padding:8px;border:1px solid #64748b;border-radius:6px;font-size:1rem;color:#0f172a;background:#ffffff}\n.ahftn-out{margin-top:16px;padding:14px;border-left:4px solid #2563eb;background:#eff6ff;color:#0f172a;min-height:48px}\na.ahftn-btn.wp-element-button{display:inline-block;margin-top:12px;background:#2563eb!important;color:#ffffff!important;text-decoration:none!important;padding:10px 16px;border-radius:6px}\n<\/style>\n<div class=\"ahftn-tool\" data-ahftn=\"tool\">\n  <h3>Find Why Your File Type Is Not Permitted<\/h3>\n  <label id=\"ahftn-l1\" for=\"ahftn-s1\">What kind of file are you uploading?<\/label>\n  <select id=\"ahftn-s1\" data-ahftn=\"kind\" aria-labelledby=\"ahftn-l1\">\n    <option value=\"\">Choose one<\/option>\n    <option value=\"ext\">An SVG, JSON, font or other file type WordPress does not list<\/option>\n    <option value=\"img\">A photo or image that opens fine on my computer<\/option>\n    <option value=\"ren\">A file I renamed to a different extension<\/option>\n    <option value=\"exe\">A script or web file such as PHP, JS or HTML<\/option>\n    <option value=\"empty\">A file that looks empty<\/option>\n  <\/select>\n  <label id=\"ahftn-l2\" for=\"ahftn-s2\">Which account are you using?<\/label>\n  <select id=\"ahftn-s2\" data-ahftn=\"who\" aria-labelledby=\"ahftn-l2\">\n    <option value=\"\">Pick one<\/option>\n    <option value=\"admin\">Administrator on a single site<\/option>\n    <option value=\"other\">Editor, author or a network site<\/option>\n  <\/select>\n  <div class=\"ahftn-out\" id=\"ahftn-out\" aria-live=\"polite\">Answer the questions above and the likely cause appears here.<\/div>\n  <a class=\"ahftn-btn wp-element-button\" id=\"ahftn-go\" href=\"#file-type-is-not-permitted-decoder-table\">Read the matching section<\/a>\n<\/div>\n<script>(function(){\n  document.addEventListener('DOMContentLoaded', function(){\n    var root = document.querySelector('.ahftn-tool');\n    if (!root) { return; }\n    var out = document.getElementById('ahftn-out');\n    if (!out) { return; }\n    var go = document.getElementById('ahftn-go');\n    if (!go) { return; }\n    var state = { kind: '', who: '' };\n    var tails = {\n      admin: ' An administrator does not skip the check on a default install, so the account is not the fix.',\n      other: ' This account has even fewer rights than an administrator, so the allowed-type list is the part to change.'\n    };\n    function show(text, anchor) {\n      var extra = tails[state.who];\n      if (!extra) { extra = ''; }\n      out.textContent = text + extra;\n      go.setAttribute('href', anchor);\n    }\n    function decide() {\n      if (state.kind === '') { return; }\n      if (state.kind === 'ext') {\n        show('The extension is missing from the allowed list. Add that one type with the upload_mimes filter, or convert the file to a type WordPress already lists.', '#fix-file-type-is-not-permitted-upload-mimes');\n        return;\n      }\n      if (state.kind === 'img') {\n        show('The extension is allowed but the content check disagreed. Open the file in an image editor and save it again in the format you need, then upload the new copy.', '#file-type-is-not-permitted-content-mismatch');\n        return;\n      }\n      if (state.kind === 'ren') {\n        show('WordPress reads the content as well as the name. A renamed file reports its real type, and a text file named as an image is refused. Save the file in the format you want instead of renaming it.', '#file-type-is-not-permitted-content-mismatch');\n        return;\n      }\n      if (state.kind === 'exe') {\n        show('Script and web files are the types the allowed list guards most closely. PHP is not on it at all, and JS and HTML need the unfiltered HTML capability. Use a plugin or the file manager for code, not the Media Library.', '#files-the-file-type-is-not-permitted-by-default');\n        return;\n      }\n      show('An empty file gets a different message, about the file being empty. Check the size on your computer, then check the upload limits and the temporary folder.', '#file-type-is-not-permitted-two-messages');\n    }\n    root.addEventListener('change', function(ev){\n      var t = ev.target;\n      if (!t) { return; }\n      var key = t.getAttribute('data-ahftn');\n      if (!key) { return; }\n      state[key] = t.value;\n      decide();\n    });\n  });\n})();<\/script>\n\n\n\n<h2 id=\"what-ahosting-can-do-file-type-is-not-permitted\" class=\"wp-block-heading\">What Can AHosting Do? <\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Once you know which check failed, the fix is one filter, one converted file or one removed constant. The part you cannot see from the dashboard is how fileinfo reads your file and whether something on the account changes the request. If a plain JPEG is refused, or the message is neither sentence above, open a ticket with the exact text, the file name and the page where you uploaded it, and we will look at it with you.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">The shared plans on our <a href=\"https:\/\/www.ahosting.net\/web-hosting.html\">web hosting page<\/a> include a cPanel File Manager and FTP access, which is the right route for code files that do not belong in the Media Library. The <a href=\"https:\/\/www.ahosting.net\/wordpress-hosting.html\">WordPress hosting plans<\/a> are the page to compare if you want the upload and file work handled on a WordPress-focused account. If you meet this after every client launch, see the <a href=\"https:\/\/www.ahosting.net\/reseller-hosting.html\">reseller hosting plans<\/a>.<\/p>\n\n\n\n<h2 id=\"faq-sorry-this-file-type-is-not-permitted-for-security-reasons\" class=\"wp-block-heading\">Frequently Asked Questions: File Type Is Not Permitted<\/h2>\n\n\n\n<h3 id=\"faq-why-file-type-is-not-permitted-2026\" class=\"wp-block-heading\">Why does WordPress keep saying the file type is not permitted in 2026?<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">Specifically, WordPress compared your file with its list of allowed types and found no match. The comparison looks at the extension, at the real content of the file and at your user capabilities. SVG, JSON and font files fail the first check on every default install.<\/p>\n\n\n\n<h3 id=\"faq-fix-svg-file-type-is-not-permitted-2026\" class=\"wp-block-heading\">How do I fix the file type is not permitted error for SVG files in WordPress 2026?<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">In practice, add the SVG type to the upload_mimes filter in a small plugin, then upload again. In our lab on WordPress 7.1.4 that one filter let SVG, JSON and WOFF2 files through. Remember that an SVG is a text document that can carry script, so allow it only for people you trust.<\/p>\n\n\n\n<h3 id=\"faq-file-type-is-not-permitted-vs-not-allowed\" class=\"wp-block-heading\">Is the file type is not permitted message vs not allowed to upload this file type the same error?<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">Indeed, they are the same check with different wording. WordPress 5.2 printed the first sentence and WordPress 5.9 and later print the second at the same place in the upload code. The cause and the fixes are identical, so use whichever text you see.<\/p>\n\n\n\n<h3 id=\"faq-admin-file-type-is-not-permitted\" class=\"wp-block-heading\">Why is the file type is not permitted even when I am logged in as an administrator?<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">Typically, the administrator role does not skip the check on a default install. The skip needs the unfiltered upload capability, and WordPress grants it only when a constant in wp-config.php switches it on. In our lab an administrator was refused SVG, JSON, PHP and font files.<\/p>\n\n\n\n<h3 id=\"faq-allow-unfiltered-uploads-vs-upload-mimes\" class=\"wp-block-heading\">Is ALLOW_UNFILTERED_UPLOADS vs the upload_mimes filter the safer fix when the file type is not permitted?<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">Overall, the filter is the safer fix. It opens one named type and every other check still runs. The constant removes the check for every user who holds the capability, and in our lab it accepted a text file named as a JPEG and a PHP file.<\/p>\n\n\n\n<h3 id=\"faq-renamed-file-type-is-not-permitted\" class=\"wp-block-heading\">Why does WordPress say the file type is not permitted for a text file I renamed to .jpg?<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">In fact, WordPress reads the file content as well as its name. The content check reported plain text, which does not match the JPEG type that the extension claims, so the upload was refused. Save a real image in the format you need rather than renaming one.<\/p>\n\n\n\n<h3 id=\"faq-ahosting-support-file-type-is-not-permitted\" class=\"wp-block-heading\">Can AHosting support tell me why the file type is not permitted on my WordPress upload?<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">Specifically, open a ticket with the exact message, the file name and extension, and what happened when you tried a small real image. That tells us whether this is the allowed-type list, a content mismatch or something on the server, so the first reply can be specific.<\/p>\n\n\n\n<h3 id=\"faq-ahosting-server-setting-file-type-is-not-permitted\" class=\"wp-block-heading\">Should I ask AHosting to change a server setting when the file type is not permitted?<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">Typically, no. In our lab the message came from WordPress core code, which ships with WordPress itself. Ask us only if a plain JPEG is refused, if the message differs from the two WordPress sentences, or if a security rule blocks the request before WordPress runs.<\/p>\n\n\n\n<h3 id=\"faq-update-file-type-is-not-permitted-2026\" class=\"wp-block-heading\">Will the file type is not permitted error go away after I update WordPress in 2026?<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">Overall, an update will not add SVG, JSON or font types to the allowed list. WordPress 7.1.4 still has no entry for them, and the message wording only changed between the 5.2 and 5.9 releases. Keep the site current, then handle the type with the filter.<\/p>\n\n\n\n<h3 id=\"faq-ahosting-zip-vs-convert-file-type-is-not-permitted\" class=\"wp-block-heading\">On AHosting WordPress hosting, is zipping a blocked file better vs converting it when the file type is not permitted?<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">Ultimately, converting is the cleaner choice when a standard format exists, such as a PNG or JPEG. WordPress lists ZIP as an allowed type in its source, and we did not upload a ZIP in our lab. A zip hides the file inside a download, so readers cannot see it on the page.<\/p>\n\n\n\n<script>\n(function(){\n  document.addEventListener('DOMContentLoaded', function(){\n    var allH3s = document.querySelectorAll('h3.wp-block-heading');\n    var inFaq = false;\n    for (var i = 0; i < allH3s.length; i++) {\n      var h3 = allH3s[i];\n      var prev = h3.previousElementSibling;\n      if (prev) {\n        if (prev.tagName === 'H2') {\n          var prevId = prev.getAttribute('id');\n          if (prevId) {\n            if (prevId.indexOf('faq-') === 0) {\n              inFaq = true;\n            } else {\n              inFaq = false;\n            }\n          }\n        }\n      }\n      if (inFaq) {\n        initToggle(h3);\n      }\n    }\n    function initToggle(h3) {\n      var answer = h3.nextElementSibling;\n      if (!answer) { return; }\n      if (answer.tagName !== 'P') { return; }\n      answer.style.display = 'none';\n      h3.style.cursor = 'pointer';\n      h3.setAttribute('tabindex', '0');\n      h3.setAttribute('aria-expanded', 'false');\n      h3.addEventListener('click', function(){\n        toggleOne(h3, answer);\n      });\n      h3.addEventListener('keydown', function(ev){\n        if (ev.key === 'Enter') { toggleOne(h3, answer); }\n        if (ev.key === ' ') { ev.preventDefault(); toggleOne(h3, answer); }\n      });\n    }\n    function toggleOne(h3, answer) {\n      var open = h3.getAttribute('aria-expanded') === 'true';\n      if (open) {\n        answer.style.display = 'none';\n        h3.setAttribute('aria-expanded', 'false');\n      } else {\n        answer.style.display = 'block';\n        h3.setAttribute('aria-expanded', 'true');\n      }\n    }\n  });\n})();\n<\/script>\n","protected":false},"excerpt":{"rendered":"<p>TL;DR WordPress refuses an upload when the extension is not on its allowed list, when the real content of the file does not match the extension, or when neither check passes and your account lacks the unfiltered upload capability. SVG, JSON and font files fail the first check on a default install. In a WordPress [&hellip;]<\/p>\n","protected":false},"author":2,"featured_media":1528,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_monsterinsights_skip_tracking":false,"footnotes":""},"categories":[8],"tags":[340,341,343,27,113,117,342],"class_list":["post-1527","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-wordpress","tag-file-type-is-not-permitted","tag-media-library","tag-svg-upload","tag-wordpress","tag-wordpress-errors","tag-wordpress-troubleshooting","tag-wordpress-upload-errors"],"aioseo_notices":[],"aioseo_head":"\n\t\t<!-- All in One SEO 5.0.4 - aioseo.com -->\n\t<meta name=\"description\" content=\"A file type is not permitted error comes from three checks. Learn which one failed, with WordPress 7.1.4 lab results, and fix it safely.\" \/>\n\t<meta name=\"robots\" content=\"max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n\t<meta name=\"author\" content=\"Matt Chrust\"\/>\n\t<link rel=\"canonical\" href=\"https:\/\/www.ahosting.net\/blog\/sorry-this-file-type-is-not-permitted-for-security-reasons\/\" \/>\n\t\t<meta name=\"generator\" content=\"All in One SEO (AIOSEO) 5.0.4\" \/>\n\t\t<meta property=\"og:locale\" content=\"en_US\" \/>\n\t\t<meta property=\"og:site_name\" content=\"AHosting Blog | WordPress Hosting Tips &amp; Guides\" \/>\n\t\t<meta property=\"og:type\" content=\"article\" \/>\n\t\t<meta property=\"og:title\" content=\"File Type Is Not Permitted in WordPress: Fix It | AHosting\" \/>\n\t\t<meta property=\"og:description\" content=\"A file type is not permitted error comes from three checks. Learn which one failed, with WordPress 7.1.4 lab results, and fix it safely.\" \/>\n\t\t<meta property=\"og:url\" content=\"https:\/\/www.ahosting.net\/blog\/sorry-this-file-type-is-not-permitted-for-security-reasons\/\" \/>\n\t\t<meta property=\"og:image\" content=\"https:\/\/www.ahosting.net\/blog\/wp-content\/uploads\/2026\/10\/sorry-this-file-type-is-not-permitted-for-security-reasons-ahosting.jpg\" \/>\n\t\t<meta property=\"og:image:secure_url\" content=\"https:\/\/www.ahosting.net\/blog\/wp-content\/uploads\/2026\/10\/sorry-this-file-type-is-not-permitted-for-security-reasons-ahosting.jpg\" \/>\n\t\t<meta property=\"og:image:width\" content=\"1200\" \/>\n\t\t<meta property=\"og:image:height\" content=\"675\" \/>\n\t\t<meta property=\"article:published_time\" content=\"2026-10-28T22:36:58+00:00\" \/>\n\t\t<meta property=\"article:modified_time\" content=\"2026-10-28T22:36:59+00:00\" \/>\n\t\t<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n\t\t<meta name=\"twitter:site\" content=\"@ahostingdotnet\" \/>\n\t\t<meta name=\"twitter:title\" content=\"File Type Is Not Permitted in WordPress: Fix It | AHosting\" \/>\n\t\t<meta name=\"twitter:description\" content=\"A file type is not permitted error comes from three checks. Learn which one failed, with WordPress 7.1.4 lab results, and fix it safely.\" \/>\n\t\t<meta name=\"twitter:creator\" content=\"@ahostingdotnet\" \/>\n\t\t<meta name=\"twitter:image\" content=\"https:\/\/www.ahosting.net\/blog\/wp-content\/uploads\/2026\/10\/sorry-this-file-type-is-not-permitted-for-security-reasons-ahosting.jpg\" \/>\n\t\t<script type=\"application\/ld+json\" class=\"aioseo-schema\">\n\t\t\t{\"@context\":\"https:\\\/\\\/schema.org\",\"@graph\":[{\"@type\":\"BlogPosting\",\"@id\":\"https:\\\/\\\/www.ahosting.net\\\/blog\\\/sorry-this-file-type-is-not-permitted-for-security-reasons\\\/#article\",\"name\":\"File Type Is Not Permitted in WordPress: Fix It | AHosting\",\"headline\":\"Sorry, This File Type Is Not Permitted for Security Reasons: What WordPress Checks and How to Fix It\",\"author\":{\"@type\":\"Person\",\"name\":\"Matt Chrust\",\"url\":\"https:\\\/\\\/www.ahosting.net\\\/blog\\\/author\\\/matt-chrust\\\/\"},\"publisher\":{\"@id\":\"https:\\\/\\\/www.ahosting.net\\\/#organization\"},\"image\":{\"@type\":\"ImageObject\",\"url\":\"https:\\\/\\\/www.ahosting.net\\\/blog\\\/wp-content\\\/uploads\\\/2026\\\/10\\\/sorry-this-file-type-is-not-permitted-for-security-reasons-ahosting.jpg\",\"width\":1200,\"height\":675,\"caption\":\"File type is not permitted: extension, real content and one capability decide the upload. By Matt Chrust, Director of Business Development, AHosting.\"},\"datePublished\":\"2026-10-28T22:36:58+00:00\",\"dateModified\":\"2026-10-28T22:36:59+00:00\",\"inLanguage\":\"en-US\",\"mainEntityOfPage\":{\"@id\":\"https:\\\/\\\/www.ahosting.net\\\/blog\\\/sorry-this-file-type-is-not-permitted-for-security-reasons\\\/#webpage\"},\"isPartOf\":{\"@id\":\"https:\\\/\\\/www.ahosting.net\\\/blog\\\/sorry-this-file-type-is-not-permitted-for-security-reasons\\\/#webpage\"},\"articleSection\":\"WordPress, file type is not permitted, Media Library, SVG upload, WordPress, WordPress errors, WordPress troubleshooting, WordPress upload errors\"},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\\\/\\\/www.ahosting.net\\\/blog\\\/sorry-this-file-type-is-not-permitted-for-security-reasons\\\/#breadcrumblist\",\"itemListElement\":[{\"@type\":\"ListItem\",\"@id\":\"https:\\\/\\\/www.ahosting.net\\\/blog\\\/#listItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\\\/\\\/www.ahosting.net\\\/blog\\\/\",\"nextItem\":{\"@type\":\"ListItem\",\"@id\":\"https:\\\/\\\/www.ahosting.net\\\/blog\\\/category\\\/wordpress\\\/#listItem\",\"name\":\"WordPress\"}},{\"@type\":\"ListItem\",\"@id\":\"https:\\\/\\\/www.ahosting.net\\\/blog\\\/category\\\/wordpress\\\/#listItem\",\"position\":2,\"name\":\"WordPress\",\"item\":\"https:\\\/\\\/www.ahosting.net\\\/blog\\\/category\\\/wordpress\\\/\",\"nextItem\":{\"@type\":\"ListItem\",\"@id\":\"https:\\\/\\\/www.ahosting.net\\\/blog\\\/sorry-this-file-type-is-not-permitted-for-security-reasons\\\/#listItem\",\"name\":\"Sorry, This File Type Is Not Permitted for Security Reasons: What WordPress Checks and How to Fix It\"},\"previousItem\":{\"@type\":\"ListItem\",\"@id\":\"https:\\\/\\\/www.ahosting.net\\\/blog\\\/#listItem\",\"name\":\"Home\"}},{\"@type\":\"ListItem\",\"@id\":\"https:\\\/\\\/www.ahosting.net\\\/blog\\\/sorry-this-file-type-is-not-permitted-for-security-reasons\\\/#listItem\",\"position\":3,\"name\":\"Sorry, This File Type Is Not Permitted for Security Reasons: What WordPress Checks and How to Fix It\",\"previousItem\":{\"@type\":\"ListItem\",\"@id\":\"https:\\\/\\\/www.ahosting.net\\\/blog\\\/category\\\/wordpress\\\/#listItem\",\"name\":\"WordPress\"},\"item\":\"https:\\\/\\\/www.ahosting.net\\\/blog\\\/sorry-this-file-type-is-not-permitted-for-security-reasons\\\/\"}]},{\"@type\":\"Organization\",\"@id\":\"https:\\\/\\\/www.ahosting.net\\\/#organization\",\"name\":\"AHosting\",\"description\":\"WordPress Hosting Tips & Guides\",\"url\":\"https:\\\/\\\/www.ahosting.net\\\/\",\"logo\":{\"@type\":\"ImageObject\",\"url\":\"https:\\\/\\\/www.ahosting.net\\\/assets\\\/img\\\/ahosting-logo.svg\",\"@id\":\"https:\\\/\\\/www.ahosting.net\\\/blog\\\/sorry-this-file-type-is-not-permitted-for-security-reasons\\\/#organizationLogo\"},\"image\":{\"@id\":\"https:\\\/\\\/www.ahosting.net\\\/blog\\\/sorry-this-file-type-is-not-permitted-for-security-reasons\\\/#organizationLogo\"},\"sameAs\":[\"https:\\\/\\\/x.com\\\/ahostingdotnet\"]},{\"@type\":\"Person\",\"@id\":\"https:\\\/\\\/www.ahosting.net\\\/blog\\\/author\\\/matt-chrust\\\/#author\",\"url\":\"https:\\\/\\\/www.ahosting.net\\\/blog\\\/author\\\/matt-chrust\\\/\",\"name\":\"Matt Chrust\",\"image\":{\"@type\":\"ImageObject\",\"@id\":\"https:\\\/\\\/www.ahosting.net\\\/blog\\\/sorry-this-file-type-is-not-permitted-for-security-reasons\\\/#authorImage\",\"url\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/795895edac1c44589f6c7f5e6bb79df405fbbaac15817bdd387ec57da61731ec?s=96&d=mm&r=g\",\"width\":96,\"height\":96,\"caption\":\"Matt Chrust\"}},{\"@type\":\"WebPage\",\"@id\":\"https:\\\/\\\/www.ahosting.net\\\/blog\\\/sorry-this-file-type-is-not-permitted-for-security-reasons\\\/#webpage\",\"url\":\"https:\\\/\\\/www.ahosting.net\\\/blog\\\/sorry-this-file-type-is-not-permitted-for-security-reasons\\\/\",\"name\":\"File Type Is Not Permitted in WordPress: Fix It | AHosting\",\"description\":\"A file type is not permitted error comes from three checks. Learn which one failed, with WordPress 7.1.4 lab results, and fix it safely.\",\"inLanguage\":\"en-US\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/www.ahosting.net\\\/blog\\\/#website\"},\"breadcrumb\":{\"@id\":\"https:\\\/\\\/www.ahosting.net\\\/blog\\\/sorry-this-file-type-is-not-permitted-for-security-reasons\\\/#breadcrumblist\"},\"author\":{\"@id\":\"https:\\\/\\\/www.ahosting.net\\\/blog\\\/author\\\/matt-chrust\\\/#author\"},\"creator\":{\"@id\":\"https:\\\/\\\/www.ahosting.net\\\/blog\\\/author\\\/matt-chrust\\\/#author\"},\"image\":{\"@type\":\"ImageObject\",\"url\":\"https:\\\/\\\/www.ahosting.net\\\/blog\\\/wp-content\\\/uploads\\\/2026\\\/10\\\/sorry-this-file-type-is-not-permitted-for-security-reasons-ahosting.jpg\",\"@id\":\"https:\\\/\\\/www.ahosting.net\\\/blog\\\/sorry-this-file-type-is-not-permitted-for-security-reasons\\\/#mainImage\",\"width\":1200,\"height\":675,\"caption\":\"File type is not permitted: extension, real content and one capability decide the upload. By Matt Chrust, Director of Business Development, AHosting.\"},\"primaryImageOfPage\":{\"@id\":\"https:\\\/\\\/www.ahosting.net\\\/blog\\\/sorry-this-file-type-is-not-permitted-for-security-reasons\\\/#mainImage\"},\"datePublished\":\"2026-10-28T22:36:58+00:00\",\"dateModified\":\"2026-10-28T22:36:59+00:00\"},{\"@type\":\"WebSite\",\"@id\":\"https:\\\/\\\/www.ahosting.net\\\/#website\",\"url\":\"https:\\\/\\\/www.ahosting.net\\\/\",\"name\":\"AHosting\",\"description\":\"WordPress Hosting Tips & Guides\",\"inLanguage\":\"en-US\",\"publisher\":{\"@id\":\"https:\\\/\\\/www.ahosting.net\\\/#organization\"}}]}\n\t\t<\/script>\n\t\t<!-- All in One SEO -->\n\n","aioseo_head_json":{"title":"File Type Is Not Permitted in WordPress: Fix It | AHosting","description":"A file type is not permitted error comes from three checks. Learn which one failed, with WordPress 7.1.4 lab results, and fix it safely.","canonical_url":"https:\/\/www.ahosting.net\/blog\/sorry-this-file-type-is-not-permitted-for-security-reasons\/","robots":"max-snippet:-1, max-image-preview:large, max-video-preview:-1","keywords":"","webmasterTools":{"miscellaneous":""},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"BlogPosting","@id":"https:\/\/www.ahosting.net\/blog\/sorry-this-file-type-is-not-permitted-for-security-reasons\/#article","name":"File Type Is Not Permitted in WordPress: Fix It | AHosting","headline":"Sorry, This File Type Is Not Permitted for Security Reasons: What WordPress Checks and How to Fix It","author":{"@type":"Person","name":"Matt Chrust","url":"https:\/\/www.ahosting.net\/blog\/author\/matt-chrust\/"},"publisher":{"@id":"https:\/\/www.ahosting.net\/#organization"},"image":{"@type":"ImageObject","url":"https:\/\/www.ahosting.net\/blog\/wp-content\/uploads\/2026\/10\/sorry-this-file-type-is-not-permitted-for-security-reasons-ahosting.jpg","width":1200,"height":675,"caption":"File type is not permitted: extension, real content and one capability decide the upload. By Matt Chrust, Director of Business Development, AHosting."},"datePublished":"2026-10-28T22:36:58+00:00","dateModified":"2026-10-28T22:36:59+00:00","inLanguage":"en-US","mainEntityOfPage":{"@id":"https:\/\/www.ahosting.net\/blog\/sorry-this-file-type-is-not-permitted-for-security-reasons\/#webpage"},"isPartOf":{"@id":"https:\/\/www.ahosting.net\/blog\/sorry-this-file-type-is-not-permitted-for-security-reasons\/#webpage"},"articleSection":"WordPress, file type is not permitted, Media Library, SVG upload, WordPress, WordPress errors, WordPress troubleshooting, WordPress upload errors"},{"@type":"BreadcrumbList","@id":"https:\/\/www.ahosting.net\/blog\/sorry-this-file-type-is-not-permitted-for-security-reasons\/#breadcrumblist","itemListElement":[{"@type":"ListItem","@id":"https:\/\/www.ahosting.net\/blog\/#listItem","position":1,"name":"Home","item":"https:\/\/www.ahosting.net\/blog\/","nextItem":{"@type":"ListItem","@id":"https:\/\/www.ahosting.net\/blog\/category\/wordpress\/#listItem","name":"WordPress"}},{"@type":"ListItem","@id":"https:\/\/www.ahosting.net\/blog\/category\/wordpress\/#listItem","position":2,"name":"WordPress","item":"https:\/\/www.ahosting.net\/blog\/category\/wordpress\/","nextItem":{"@type":"ListItem","@id":"https:\/\/www.ahosting.net\/blog\/sorry-this-file-type-is-not-permitted-for-security-reasons\/#listItem","name":"Sorry, This File Type Is Not Permitted for Security Reasons: What WordPress Checks and How to Fix It"},"previousItem":{"@type":"ListItem","@id":"https:\/\/www.ahosting.net\/blog\/#listItem","name":"Home"}},{"@type":"ListItem","@id":"https:\/\/www.ahosting.net\/blog\/sorry-this-file-type-is-not-permitted-for-security-reasons\/#listItem","position":3,"name":"Sorry, This File Type Is Not Permitted for Security Reasons: What WordPress Checks and How to Fix It","previousItem":{"@type":"ListItem","@id":"https:\/\/www.ahosting.net\/blog\/category\/wordpress\/#listItem","name":"WordPress"},"item":"https:\/\/www.ahosting.net\/blog\/sorry-this-file-type-is-not-permitted-for-security-reasons\/"}]},{"@type":"Organization","@id":"https:\/\/www.ahosting.net\/#organization","name":"AHosting","description":"WordPress Hosting Tips & Guides","url":"https:\/\/www.ahosting.net\/","logo":{"@type":"ImageObject","url":"https:\/\/www.ahosting.net\/assets\/img\/ahosting-logo.svg","@id":"https:\/\/www.ahosting.net\/blog\/sorry-this-file-type-is-not-permitted-for-security-reasons\/#organizationLogo"},"image":{"@id":"https:\/\/www.ahosting.net\/blog\/sorry-this-file-type-is-not-permitted-for-security-reasons\/#organizationLogo"},"sameAs":["https:\/\/x.com\/ahostingdotnet"]},{"@type":"Person","@id":"https:\/\/www.ahosting.net\/blog\/author\/matt-chrust\/#author","url":"https:\/\/www.ahosting.net\/blog\/author\/matt-chrust\/","name":"Matt Chrust","image":{"@type":"ImageObject","@id":"https:\/\/www.ahosting.net\/blog\/sorry-this-file-type-is-not-permitted-for-security-reasons\/#authorImage","url":"https:\/\/secure.gravatar.com\/avatar\/795895edac1c44589f6c7f5e6bb79df405fbbaac15817bdd387ec57da61731ec?s=96&d=mm&r=g","width":96,"height":96,"caption":"Matt Chrust"}},{"@type":"WebPage","@id":"https:\/\/www.ahosting.net\/blog\/sorry-this-file-type-is-not-permitted-for-security-reasons\/#webpage","url":"https:\/\/www.ahosting.net\/blog\/sorry-this-file-type-is-not-permitted-for-security-reasons\/","name":"File Type Is Not Permitted in WordPress: Fix It | AHosting","description":"A file type is not permitted error comes from three checks. Learn which one failed, with WordPress 7.1.4 lab results, and fix it safely.","inLanguage":"en-US","isPartOf":{"@id":"https:\/\/www.ahosting.net\/blog\/#website"},"breadcrumb":{"@id":"https:\/\/www.ahosting.net\/blog\/sorry-this-file-type-is-not-permitted-for-security-reasons\/#breadcrumblist"},"author":{"@id":"https:\/\/www.ahosting.net\/blog\/author\/matt-chrust\/#author"},"creator":{"@id":"https:\/\/www.ahosting.net\/blog\/author\/matt-chrust\/#author"},"image":{"@type":"ImageObject","url":"https:\/\/www.ahosting.net\/blog\/wp-content\/uploads\/2026\/10\/sorry-this-file-type-is-not-permitted-for-security-reasons-ahosting.jpg","@id":"https:\/\/www.ahosting.net\/blog\/sorry-this-file-type-is-not-permitted-for-security-reasons\/#mainImage","width":1200,"height":675,"caption":"File type is not permitted: extension, real content and one capability decide the upload. By Matt Chrust, Director of Business Development, AHosting."},"primaryImageOfPage":{"@id":"https:\/\/www.ahosting.net\/blog\/sorry-this-file-type-is-not-permitted-for-security-reasons\/#mainImage"},"datePublished":"2026-10-28T22:36:58+00:00","dateModified":"2026-10-28T22:36:59+00:00"},{"@type":"WebSite","@id":"https:\/\/www.ahosting.net\/#website","url":"https:\/\/www.ahosting.net\/","name":"AHosting","description":"WordPress Hosting Tips & Guides","inLanguage":"en-US","publisher":{"@id":"https:\/\/www.ahosting.net\/#organization"}}]},"og:locale":"en_US","og:site_name":"AHosting Blog | WordPress Hosting Tips &amp; Guides","og:type":"article","og:title":"File Type Is Not Permitted in WordPress: Fix It | AHosting","og:description":"A file type is not permitted error comes from three checks. Learn which one failed, with WordPress 7.1.4 lab results, and fix it safely.","og:url":"https:\/\/www.ahosting.net\/blog\/sorry-this-file-type-is-not-permitted-for-security-reasons\/","og:image":"https:\/\/www.ahosting.net\/blog\/wp-content\/uploads\/2026\/10\/sorry-this-file-type-is-not-permitted-for-security-reasons-ahosting.jpg","og:image:secure_url":"https:\/\/www.ahosting.net\/blog\/wp-content\/uploads\/2026\/10\/sorry-this-file-type-is-not-permitted-for-security-reasons-ahosting.jpg","og:image:width":1200,"og:image:height":675,"article:published_time":"2026-10-28T22:36:58+00:00","article:modified_time":"2026-10-28T22:36:59+00:00","twitter:card":"summary_large_image","twitter:site":"@ahostingdotnet","twitter:title":"File Type Is Not Permitted in WordPress: Fix It | AHosting","twitter:description":"A file type is not permitted error comes from three checks. Learn which one failed, with WordPress 7.1.4 lab results, and fix it safely.","twitter:creator":"@ahostingdotnet","twitter:image":"https:\/\/www.ahosting.net\/blog\/wp-content\/uploads\/2026\/10\/sorry-this-file-type-is-not-permitted-for-security-reasons-ahosting.jpg"},"aioseo_meta_data":{"post_id":"1527","title":"File Type Is Not Permitted in WordPress: Fix It | AHosting","description":"A file type is not permitted error comes from three checks. Learn which one failed, with WordPress 7.1.4 lab results, and fix it safely.","keywords":null,"keyphrases":{"focus":{"keyphrase":"file type is not permitted","score":0,"analysis":[]},"additional":[]},"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":"","og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"Article","isEnabled":true},"graphs":[]},"schema_type":"default","schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":"-1","robots_max_videopreview":"-1","robots_max_imagepreview":"large","priority":null,"frequency":"default","local_seo":null,"breadcrumb_settings":null,"limit_modified_date":false,"ai":{"faqs":[],"keyPoints":[],"schemas":[],"titles":[],"descriptions":[],"socialPosts":{"email":{"subject":"","preview":"","content":""},"linkedin":[],"twitter":[],"facebook":[],"instagram":[]}},"created":"2026-10-28 22:25:45","updated":"2026-10-28 22:39:15","seo_analyzer_scan_date":null,"focus_keyword":"file type is not permitted","additional_keywords":null,"truseo_locale":null},"aioseo_breadcrumb":"<div class=\"aioseo-breadcrumbs\"><span class=\"aioseo-breadcrumb\">\n\t\t\t<a href=\"https:\/\/www.ahosting.net\/blog\/\" title=\"Home\">Home<\/a>\n\t\t<\/span><span class=\"aioseo-breadcrumb-separator\">\u00bb<\/span><span class=\"aioseo-breadcrumb\">\n\t\t\t<a href=\"https:\/\/www.ahosting.net\/blog\/category\/wordpress\/\" title=\"WordPress\">WordPress<\/a>\n\t\t<\/span><span class=\"aioseo-breadcrumb-separator\">\u00bb<\/span><span class=\"aioseo-breadcrumb\">\n\t\t\tSorry, This File Type Is Not Permitted for Security Reasons: What WordPress Checks and How to Fix It\n\t\t<\/span><\/div>","aioseo_breadcrumb_json":[{"label":"Home","link":"https:\/\/www.ahosting.net\/blog\/"},{"label":"WordPress","link":"https:\/\/www.ahosting.net\/blog\/category\/wordpress\/"},{"label":"Sorry, This File Type Is Not Permitted for Security Reasons: What WordPress Checks and How to Fix It","link":"https:\/\/www.ahosting.net\/blog\/sorry-this-file-type-is-not-permitted-for-security-reasons\/"}],"_links":{"self":[{"href":"https:\/\/www.ahosting.net\/blog\/wp-json\/wp\/v2\/posts\/1527","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.ahosting.net\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.ahosting.net\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.ahosting.net\/blog\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/www.ahosting.net\/blog\/wp-json\/wp\/v2\/comments?post=1527"}],"version-history":[{"count":1,"href":"https:\/\/www.ahosting.net\/blog\/wp-json\/wp\/v2\/posts\/1527\/revisions"}],"predecessor-version":[{"id":1529,"href":"https:\/\/www.ahosting.net\/blog\/wp-json\/wp\/v2\/posts\/1527\/revisions\/1529"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.ahosting.net\/blog\/wp-json\/wp\/v2\/media\/1528"}],"wp:attachment":[{"href":"https:\/\/www.ahosting.net\/blog\/wp-json\/wp\/v2\/media?parent=1527"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.ahosting.net\/blog\/wp-json\/wp\/v2\/categories?post=1527"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.ahosting.net\/blog\/wp-json\/wp\/v2\/tags?post=1527"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}