‘Sorry, this file type is not permitted for security reasons’ and how to fix it

6 ways to fix the error in WordPress

Below are six reliable ways to fix the “file type not permitted” error. Choose the method that best fits your skill level and site needs.

1. Enable unfiltered uploads via wp-config.php (quickest but risky)

If you want a fast fix and you’re the only person who manages the site, you can allow all file types temporarily.

1. Connect to your website using FTP or your host’s file manager.
   
2. Open the wp-config.php file in the root folder of your WordPress site.
   
3. Add the following line just above /* That’s all, stop editing! */:
   
   define(‘ALLOW_UNFILTERED_UPLOADS’, true);
   
4. Save the file and upload it back to the server if needed.
   
5. Log out and back into WordPress to refresh your permissions.

Important: This setting only works for admin users, and it completely disables file type restrictions. It’s not recommended on multi-user sites or long term. Once you’re done uploading the file, remove the line to restore security.

2. Use the File Upload Types plugin (safe and beginner-friendly)

For a secure and beginner-friendly option, the File Upload Types plugin lets you whitelist specific file types without editing code.

1. In your WordPress dashboard, go to Plugins > Add New.
   
2. Search for File Upload Types by WPForms.
   
3. Click Install Now and then Activate.
   
4. Go to Settings > File Upload Types.
   
5. Find your file type (like SVG or WebP) in the list and check the box.
   
6. Click Save Settings.

Now you can upload that file type without triggering the error, and your site stays secure.

3. Modify functions.php to allow specific MIME types

If you’re comfortable adding a few lines of code, you can add support for specific file types directly in your theme’s functions.php file.

1. In your WordPress dashboard, go to Appearance > Theme File Editor.
   
2. Select your functions.php file from the list on the right.
   
3. Add a filter like this to allow a new MIME type:
   
   function allow_custom_mime_types($mimes) {
       $mimes[‘svg’] = ‘image/svg+xml’;
       return $mimes;
   }
   add_filter(‘upload_mimes’, ‘allow_custom_mime_types’);
   
4. Click Update File.
   You can add multiple types by expanding the array:
   
   $mimes[‘webp’] = ‘image/webp’;
   $mimes[‘woff2’] = ‘font/woff2’;

Note: If your theme gets updated, this file might be overwritten. A safer long-term option is using a child theme or a custom plugin.

4. Use a custom plugin to manage MIME types

Instead of editing your theme, you can place the same code into a simple plugin that won’t be affected by theme updates.

1. Open your site files using FTP or your host’s file manager.
   
2. Go to /wp-content/plugins/ and create a new folder like custom-mime-types.
   
3. Inside that folder, create a file named custom-mime-types.php.
   
4. Paste this into the file:
   
   <?php
   /*
   Plugin Name: Custom MIME Types
   */
   function allow_custom_mime_types($mimes) {
       $mimes[‘svg’] = ‘image/svg+xml’;
       return $mimes;
   }
   
5. add_filter(‘upload_mimes’, ‘allow_custom_mime_types’);Save and activate your plugin in the WordPress dashboard under Plugins.

This method makes your MIME type changes permanent and independent of your theme.

5. Temporarily disable security plugins

Some security plugins—like Wordfence, iThemes Security, or Sucuri—add extra restrictions on file uploads.

If nothing else is working:

1. Go to Plugins > Installed Plugins.
   
2. Temporarily deactivate your security plugin.
   
3. Try uploading the file again.
   
4. If it works, re-enable the plugin and check its settings for file type rules.

Look for options like “Upload File Restrictions” or “Disallowed File Types” and adjust them to suit your needs.

6. Check hosting-level restrictions

If none of the above options work, your hosting provider may be blocking the file type at the server level. This can happen with managed hosts or if your server uses strict MIME-type settings in Apache or NGINX.

In this case:

• Contact your host’s support team.
• Ask if they’re blocking uploads of a specific MIME type.
• Request an exception or help configuring your server settings.