Sorry, This File Type Is Not Permitted in WordPress

Updated 5 November 2026 · Standard formula, shown below

The “Sorry, this file type is not permitted for security reasons” message appears when WordPress does not allow the format you are trying to upload. You can often fix it by checking the file first, using a trusted upload plugin, or adjusting a site setting—but only enable formats you understand and need.

What You’ll Need

Administrator access to the WordPress dashboard.
The original file and a way to confirm its actual format, such as your computer’s file properties or a trusted file-inspection tool.
A recent backup of your site before changing code or settings.
If you cannot change the setting yourself, access to your hosting provider or a site administrator.

Step-by-Step

Confirm the real file type. Check the file extension and, if possible, its properties or MIME type. An extension is the letters after the final period, such as .svg or .webp. Do not simply rename a file to make it appear to be an allowed format: changing the name does not convert the file and can create a security risk. If the file came from an unknown source, do not upload it.
Check whether WordPress already supports the format. Try uploading a known, ordinary image such as a JPEG or PNG. If that succeeds but the file in question fails, the format may not be permitted by WordPress or your site’s configuration. If even common files fail, check for a broader upload, permissions, storage, or server issue instead.
Use a suitable alternative format when possible. If the file is an image or document that can safely be exported to a format your site accepts, create a genuine converted copy using reputable software. For example, export an image to JPEG or PNG if those formats meet your needs. Conversion may remove features such as transparency or animation, so check the result before replacing the original.
Ask the site administrator or host about the restriction. On a managed, school, workplace, or multi-user site, an administrator or hosting provider may deliberately restrict uploads. Ask whether the specific format is permitted and whether a server-level rule or security plugin is blocking it. Do not try to bypass a policy or upload a file type you have not verified.
For a trusted format, allow it with a reputable plugin if appropriate. In the dashboard, go to Plugins → Add New, find a maintained plugin that explicitly manages permitted upload MIME types, and review its documentation and compatibility information. Install it only if you trust the developer and understand the security implications. Add only the required file type, then save the plugin’s settings and retry the upload. Avoid plugins that broadly allow every file type.
Consider a code change only if you can maintain it. A developer can use WordPress’s upload_mimes filter to allow a specific extension and MIME type. Put custom code in a small site-specific plugin or another maintainable location—not in a theme file that may be overwritten during an update. The correct MIME type depends on the format; do not guess it. Back up the site, test on staging if available, and have the developer verify the file’s contents and server handling.
Retest and remove unnecessary access. Upload a safe, verified example of the format, then confirm it appears correctly in the Media Library and works as expected on the site. If the upload still fails, restore the previous setting or disable the change and continue with troubleshooting. Remove any temporary permissions or plugins that are no longer needed.

Common Mistakes

Renaming instead of converting: Changing file.xyz to file.jpg does not change its data or make it a JPEG.
Allowing every extension: Broad permissions can let users upload risky or executable content. Allow only formats that are necessary and understood.
Editing the wrong file: Theme updates can erase edits to a theme’s functions.php. A site-specific plugin or developer-managed change is more maintainable.
Guessing the MIME type: A mismatch between the extension and MIME type can cause rejection or unsafe handling. Verify both with a reliable source.
Ignoring who can upload: Allowing a format is more consequential on a site where many accounts can upload files than on a tightly controlled site.

Tips

Keep WordPress, plugins, and themes updated, and use only maintained software from sources you trust.
Restrict upload permissions to users who need them. Review the relevant plugin or role settings rather than assuming a format change is safe for every account.
Keep a clean copy of the original file and test conversions before using them on a live page.
Make one change at a time so you can identify what resolved the error and undo it if needed.

Troubleshooting

The plugin is active, but the error remains: Confirm that the exact extension and MIME type are enabled in its settings, then save again and retry. Check whether another security or upload plugin, a multisite administrator, or the host is enforcing a separate restriction. If you do not manage those settings, ask the administrator or host to check the server logs and policy.

The file is accepted but will not display: The extension may not match the file’s contents, or the browser and site may not support how it is served. Verify the file, use a standard compatible format, and remove the upload if it behaves unexpectedly. Do not assume successful upload means the file is safe.

Even common image files fail: Check the Media Library for storage or permission errors, available hosting storage, and any upload-size limit shown by WordPress or your host. A size limit usually produces a different message, but it can still prevent an upload. Contact the host if the dashboard does not explain the cause.

The error began after a code or plugin change: Undo that change or restore the backup, then test again. If you cannot reach the dashboard, use your host’s recovery or file-management tools carefully, or ask its support team for help. Avoid deleting unfamiliar files.

Frequently Asked Questions

Why does WordPress say a file type is not permitted?
WordPress or another site component does not allow the file’s format, often because of security restrictions or a server policy.

Can I upload any file type by changing WordPress settings?
Some formats can be enabled, but allowing arbitrary types is unsafe. Permit only a verified format that the site genuinely needs.

Will changing the file extension fix the problem?
No. Renaming changes the label, not the file’s contents. Convert it with appropriate software or use a correctly formatted original.

Is it safe to use a plugin to allow a file type?
It can be appropriate when the plugin is trustworthy, maintained, and configured narrowly. Check the format and who is allowed to upload it.

Why can’t I change the allowed types?
Your account may lack the required permissions, or a host, multisite administrator, or security tool may control uploads. Ask the responsible administrator.

What should I do if the upload still fails?
Recheck the file and plugin settings, then investigate other restrictions such as server policy, storage, and upload limits. Ask your host to review logs if the cause is unclear.

Method: the standard formula for this calculation, rounded as each result states. See how the calculators work or report an error.