A WordPress plugin that enables SVG uploads with validation to block malicious files.

WordPress still lacks native SVG support after 12+ years of discussion

• ✅ SVG Upload Support — Enables .svg uploads in the WordPress media library
• 🔒 Security-First Validation — Detects and rejects SVG files containing potentially harmful content
• 🖼️ Media Library Integration — SVGs display inline like standard images
• 🧩 Zero Dependencies — No external libraries or frameworks
• ⚙️ Zero Configuration — No settings or admin bloat

• PHP 8.2 or higher
• WordPress 5.9 or higher

composer require roots/allow-svg

{
    "extra": {
        "installer-paths": {
            "web/app/mu-plugins/{$name}/": [
                "type:wordpress-muplugin",
                "roots/allow-svg"
            ]
        }
    }
}

1. Download allow-svg.php
2. Place in wp-content/plugins/allow-svg/
3. Activate via wp-admin or WP-CLI

Once activated, the plugin automatically:

1. Enables SVG uploads through the Media Library or block editor
2. Performs strict validation on all SVG files
3. Rejects malicious files with clear error messages
4. Accepts clean, standards-compliant SVGs as-is

No configuration required.

This plugin uses a deny-first approach: it doesn't attempt to sanitize SVGs, it rejects files that appear unsafe.

• Basic SVG shapes, paths, text, and inline styles
• ViewBox and standard attributes

• <script> tags or inline JavaScript
• Event handlers like onclick, onload, etc.
• External references (href, xlink:href, iframe, object, embed)
• CSS expressions and @import rules
• Data URLs containing script or HTML content

• XXE Protection — Blocks <!DOCTYPE> and external entity declarations
• Entity Expansion Limits — Rejects suspicious &entity; usage
• Uses DOMDocument with external entities disabled

Allow SVG is an open source project and completely free to use. If you've benefited from our projects and would like to support our future endeavors, please consider sponsoring us.

• GitHub Issues: https://github.com/roots/allow-svg/issues
• Roots Discourse: https://discourse.roots.io/