“Sorry, you are not allowed to upload this file type” in WordPress: what we tested

Why does WordPress say “Sorry, you are not allowed to upload this file type”?

WordPress shows “Sorry, you are not allowed to upload this file type” when the file type is not on its list of allowed types. In our test it also refused a text file named .jpg, while a PNG named .jpg went in and was renamed .png. The message is the same in every case, which is why it confuses people.

We tested it on Wednesday 14 Oct 2026 on a fresh WordPress 7.1.3 site with no plugins. We sent 9 files through the same upload endpoint the Media Library uses, first as the administrator, then as an editor.

When an upload error turns up on a live site, it is one of the jobs in our WordPress fixes and care plan. Most of the time the answer is in the file itself.

Which files did WordPress refuse?

Three of the nine, as the administrator:

The administrator got the same refusal as anyone else. On a single site, even the admin account does not have the unfiltered_upload capability by default, and the Roles and Capabilities page says so.

Where does the allowed list come from?

From a function called get_allowed_mime_types(). On our test site it returned 96 entries. SVG was not one of them, and neither was JSON. WebP, AVIF and HEIC were.

The developer reference shows the source. It starts from WordPress’s full list, removes swf and exe, and removes html and js for users who cannot post unfiltered HTML. Then it runs a filter called upload_mimes, which is where plugins and snippets add types.

Why was a .jpg refused?

Because it was not a JPEG. WordPress looks at the contents as well as the extension, through wp_check_filetype_and_ext().

Our text file named text-named.jpg was refused with the same message. The PNG we had renamed to png-named.jpg went through, and WordPress fixed the name to png-named.png on the way in. The developer reference describes exactly that: when an image’s real type does not match its extension, WordPress sets a proper file name.

So if a photo from a phone or a design tool is refused, open it and save it again as a real JPEG or PNG before you touch any settings.

How do you allow SVG uploads?

The usual fix is a few lines that add svg through the upload_mimes filter. We tried it. The SVG logo uploaded for the administrator, and for the editor too, because the filter changes the list for everyone who can upload.

Then we uploaded a second SVG with a script tag inside it, as the editor. WordPress saved it and served it back as image/svg+xml with the script tag still in the file. The filter only adds a type to the list. It does not clean what is inside.

That matters because a script inside an SVG can run in the browser of anyone who opens the file’s address, which is the cross-site scripting attack OWASP describes.

If your site needs SVG logos, use a method that sanitizes the file, and give upload rights only to people you trust. We did not test any SVG plugin, so we cannot rank them.

What does ALLOW_UNFILTERED_UPLOADS do?

It switches the type check off for the administrator. We added define( ‘ALLOW_UNFILTERED_UPLOADS’, true ) to wp-config.php and ran the same files again.

The administrator could now upload all of them: the SVG, the JSON file, and the text file named .jpg, which WordPress stored as image/jpeg. The editor was still refused for all three.

That is the reason we do not leave it on. One upload, then the line comes out. We took it out in the lab and the refusals came back on the next run.

How do you fix it, step by step?

1. Check what the file really is. Open it and export it again in the format its name claims.
2. If the type is not on WordPress’s list, ask whether the site needs it at all. A JSON or ZIP file can often live somewhere else and be linked.
3. If you do need a new type, add it with the upload_mimes filter in a small plugin, not in the theme, so a theme change does not undo it.
4. For SVG, add sanitizing as well, and limit who can upload.
5. Use ALLOW_UNFILTERED_UPLOADS only for a single upload, then remove it.

When we take on a fix like this, we take a backup or a staging copy before we touch anything, and we tell you which file or setting we will change before we change it.

Is it the same as “The link you followed has expired”?

No. That one is about size. When an upload is bigger than PHP’s post_max_size, WordPress shows a different message, which we covered in the link you followed has expired: the upload limit behind it.

If the file is small and still refused, it is the type. If it is large and the page says the link expired, it is the size.

What did we not test?

Our lab covered the Media Library upload endpoint on WordPress 7.1.3 with no plugins. We did not test:

• multisite networks, where the rules for unfiltered_upload are different
• uploads through the REST API or the block editor’s image block
• SVG plugins and security plugins that change the list
• hosts that block file types in their own firewall

Our test site was a WordPress Playground install built from a script. No live host was involved.

What should you do now?

Look at the file before you look at the settings. Most refusals in our test came from a type that WordPress leaves out on purpose, or a file whose name did not match its contents.

If an upload is blocking work on your site, tell us which file and what it is for and we will look at the file and the site before anything changes.