# Allow Only Safe File Types to Be Uploaded

> Limits uploads to common images, documents, audio and video, and rejects files with a hidden second extension such as photo.php.jpg.

- Type: PHP
- Runs: Run everywhere
- Category: [Security](https://wpide.com/library/category/security/)
- Tags: security, uploads, media
- Author: WPIDE Team
- Installs: 0
- Updated: 2026-10-28
- Page: https://wpide.com/library/allow-only-safe-upload-types/

## Code

```php
// Extensions (as WordPress lists them) that may be uploaded.
$wpide_safe_upload_types = array( 'jpg|jpeg|jpe', 'png', 'gif', 'webp', 'avif', 'pdf', 'doc', 'docx', 'xls', 'xlsx', 'ppt|pps', 'pptx', 'odt', 'txt', 'csv', 'mp3|m4a|m4b', 'mp4|m4v', 'mov|qt', 'webm' );

add_filter( 'upload_mimes', function ( $mimes ) use ( $wpide_safe_upload_types ) {
    return array_intersect_key( $mimes, array_flip( $wpide_safe_upload_types ) );
}, 99 );

add_filter( 'wp_handle_upload_prefilter', function ( $file ) {
    $parts = explode( '.', strtolower( (string) $file['name'] ) );
    array_pop( $parts ); // The real extension.

    foreach ( $parts as $part ) {
        if ( in_array( $part, array( 'php', 'php3', 'php4', 'php5', 'php7', 'php8', 'phtml', 'phar', 'pht', 'shtml', 'cgi', 'exe', 'htaccess' ), true ) ) {
            $file['error'] = 'This file name is not allowed. Please rename the file and try again.';
            break;
        }
    }

    return $file;
} );
```

## Notes

Remove this snippet or extend the list before uploading other file types, such as ZIP archives or fonts.

## How to use it

Install the free WPIDE plugin (https://wordpress.org/plugins/wpide/), find "Allow Only Safe File Types to Be Uploaded" in its snippet library and add it in one click; or create a new PHP snippet in WPIDE (or any code snippets plugin) and paste the code above. More snippets: https://wpide.com/library/