# Allow SVG Uploads for Administrators

> Lets administrators upload SVG files to the Media Library. Files containing scripts, event handlers or javascript: links are rejected.

- Type: PHP
- Runs: Run everywhere
- Category: [Media](https://wpide.com/library/category/media/)
- Tags: media, svg, uploads
- Author: WPIDE Team
- Installs: 0
- Updated: 2026-10-28
- Page: https://wpide.com/library/allow-svg-uploads-for-admins/

## Code

```php
add_filter( 'upload_mimes', function ( $mimes ) {
    if ( current_user_can( 'manage_options' ) ) {
        $mimes['svg'] = 'image/svg+xml';
    }

    return $mimes;
} );

add_filter( 'wp_check_filetype_and_ext', function ( $data, $file, $filename, $mimes ) {
    if ( ! current_user_can( 'manage_options' ) ) {
        return $data;
    }

    $check = wp_check_filetype( $filename, $mimes );

    if ( 'svg' !== $check['ext'] ) {
        return $data;
    }

    $contents = is_readable( $file ) ? (string) file_get_contents( $file, false, null, 0, 2 * MB_IN_BYTES ) : '';

    if ( '' === $contents || preg_match( '/<script|\son[a-z]+\s*=|javascript:|<foreignObject/i', $contents ) ) {
        return array( 'ext' => false, 'type' => false, 'proper_filename' => false );
    }

    $data['ext']  = 'svg';
    $data['type'] = 'image/svg+xml';

    return $data;
}, 10, 4 );
```

## Notes

The check is a basic safety net, not a full SVG sanitizer. Only upload SVG files from sources you trust.

## How to use it

Install the free WPIDE plugin (https://wordpress.org/plugins/wpide/), find "Allow SVG Uploads for Administrators" in its snippet library and add it in one click; or create a new PHP snippet in WPIDE (or any code snippets plugin) and paste the code above. More snippets: https://wpide.com/library/