The cleanest, most flexible way to add new file types to WordPress is by hooking into the upload_mimes filter in your theme's functions.php file — or better yet, in a simple custom plugin.

Step 1: Access your theme's functions.php

1. Log in to your WordPress dashboard
2. Go to Appearance → Theme File Editor
3. Select functions.php from the right-hand file list
4. Scroll to the very bottom of the file

Or connect via FTP and open /wp-content/themes/your-active-theme/functions.php in a text editor.

Step 2: Add allowed file types

Add this code snippet to the bottom of functions.php:

function acemindtech_allow_file_types( $mimes ) {
    // Allow SVG files
    $mimes['svg']  = 'image/svg+xml';
    $mimes['svgz'] = 'image/svg+xml';

    // Allow font files
    $mimes['ttf']   = 'font/ttf';
    $mimes['otf']   = 'font/otf';
    $mimes['woff']  = 'font/woff';
    $mimes['woff2'] = 'font/woff2';

    // Allow JSON and XML
    $mimes['json'] = 'application/json';
    $mimes['xml']  = 'application/xml';

    // Allow CSV
    $mimes['csv'] = 'text/csv';

    return $mimes;
}
add_filter( 'upload_mimes', 'acemindtech_allow_file_types' );

Only add the file types you actually need. Remove lines for any types you don't require.

Step 3: Save and test

Save the file and try uploading the previously blocked file type again. It should now upload successfully.

If you'd rather not touch code, there are several reliable plugins that handle this for you:

WP Extra File Types (free, from wordpress.org)

This is the simplest dedicated plugin for this problem:

1. Go to Plugins → Add New and search for "WP Extra File Types"
2. Install and activate it
3. Go to Settings → Extra File Types
4. Check the boxes next to the file types you want to allow
5. Click Save Changes

Done. No code required.

SVG Support (free, from wordpress.org)

If your specific problem is uploading SVG files:

1. Install and activate SVG Support
2. Go to Settings → SVG Support
3. Enable SVG support for administrators, editors, or all users as needed
4. Optionally enable "Sanitize SVG on upload" for additional security

SVG Support also handles safe sanitization of SVG files on upload — an important security consideration covered in detail below.

WordPress 5.1 and later includes a constant you can define in wp-config.php to disable the file type security check entirely. This is the most permissive option — use it only in controlled environments where you fully trust everyone with upload access.

Open wp-config.php via FTP and add this line just before the /* That's all, stop editing! */ comment:

define( 'ALLOW_UNFILTERED_UPLOADS', true );

• A local development environment
• A staging site
• A production site where only fully trusted administrators have upload access and you have additional server-level security in place

Never use ALLOW_UNFILTERED_UPLOADS on a site where clients, contributors, or untrusted users have upload permissions.

SVG files deserve their own section because they're the most commonly needed blocked file type — and the most security-sensitive.

Unlike a JPEG or PNG, an SVG file is XML-based and can contain embedded JavaScript. This means a malicious SVG file could potentially execute scripts in a visitor's browser if displayed directly. For this reason, simply adding SVG to the allowed MIME types (as in Method 1) is not quite enough for a production site — you should also sanitize SVG files on upload.

Safe SVG plugin (recommended approach for SVGs):

1. Install and activate Safe SVG plugin (free, from wordpress.org)
2. It automatically adds SVG to the allowed file types
3. It sanitizes every SVG file on upload — stripping any embedded scripts or malicious code
4. It also renders SVG files correctly as image previews in the Media Library

This is the safest and most complete solution for SVG uploads. No additional code required.

Manual approach (if you prefer code over plugin):

Add SVG to allowed MIME types as in Method 1, plus add a sanitization function:

function acemindtech_sanitize_svg( $file ) {
    if ( $file['type'] === 'image/svg+xml' ) {
        $dirty = file_get_contents( $file['tmp_name'] );
        // Remove script tags and event handlers
        $clean = preg_replace( '//i', '', $dirty );
        $clean = preg_replace( '/on\w+="[^"]*"/i', '', $clean );
        file_put_contents( $file['tmp_name'], $clean );
    }
    return $file;
}
add_filter( 'wp_handle_upload_prefilter', 'acemindtech_sanitize_svg' );

For production sites, the Safe SVG plugin's sanitization is more thorough than a simple regex — it uses a full SVG sanitizer library. Use the plugin over the manual approach for anything other than local development.

In WordPress 4.7.1 and later, an additional layer of security was added: WordPress now verifies that a file's actual MIME type matches its extension — not just that the extension is on the allowlist.

This means that even after adding a file type to the upload_mimes filter, you may still get the error if WordPress's MIME type detection doesn't match the extension. This is especially common with SVG, JSON, and certain font files.

Fix with the wp_check_filetype_and_ext filter:

Add this to functions.php alongside your MIME type additions:

function acemindtech_fix_mime_type_check( $data, $file, $filename, $mimes ) {
    $ext     = pathinfo( $filename, PATHINFO_EXTENSION );
    $ext     = strtolower( $ext );

    $allowed = array(
        'svg'   => 'image/svg+xml',
        'svgz'  => 'image/svg+xml',
        'json'  => 'application/json',
        'xml'   => 'application/xml',
        'woff'  => 'font/woff',
        'woff2' => 'font/woff2',
        'ttf'   => 'font/ttf',
        'otf'   => 'font/otf',
    );

    if ( isset( $allowed[$ext] ) ) {
        $data['ext']  = $ext;
        $data['type'] = $allowed[$ext];
    }

    return $data;
}
add_filter( 'wp_check_filetype_and_ext', 'acemindtech_fix_mime_type_check', 10, 4 );

This tells WordPress exactly what MIME type to assign to each of these extensions, bypassing the automatic detection that can sometimes fail.

On a WordPress Multisite network, file upload restrictions are controlled at two levels: the network level and the individual site level. Even if you've added file types using the methods above, Multisite has an additional setting that must be configured by the Network Admin.

Step 1: Log in as Network Admin

1. Go to yournetwork.com/wp-admin/network/ (Network Admin dashboard)
2. Go to Settings → Network Settings

Step 2: Update the Upload File Types setting

Scroll down to the "Upload Settings" section. You'll see a field labelled "Upload file types" containing a space-separated list of allowed extensions (e.g., jpg jpeg png gif).

Add your desired file type extensions to this list, separated by spaces:

jpg jpeg png gif pdf svg svgz ttf otf woff woff2 json xml csv

Click Save Changes.

Step 3: Apply functions.php fix as well (if needed)

The Multisite settings control what the admin UI shows, but MIME type filtering still applies underneath. If you're still getting errors after updating Multisite settings, also add the upload_mimes filter from Method 1 to your theme's functions.php or a network-activated plugin.