Filter Hook since 2.0.0

upload_mimes

Filters the list of file types allowed for upload

Description

upload_mimes controls what get_allowed_mime_types() and the uploader accept — adding a type here does not make it safe by itself; WordPress still runs its own file-content checks.

When it runs

Whenever WordPress checks allowed upload types — the media uploader, wp_check_filetype(), and REST media endpoints.

Signature

apply_filters( 'upload_mimes', array $mime_types, WP_User|int|null $user );

Parameters

$mime_types array — Allowed mime type => extension pattern pairs.
$user WP_User|int|null — User the check is being made for, if any.

Examples

Basic

add_filter( 'upload_mimes', function( $mimes ) {
    $mimes['svg'] = 'image/svg+xml';
    return $mimes;
} );

Allow SVG uploads through the media library.

Common Use Cases

Allow SVG or other blocked file types
Restrict uploads to a smaller set of types by role
Add support for a niche file format

Common mistakes

Allowing SVG uploads without sanitizing them — SVG can contain embedded scripts, a real XSS risk

Related hooks

Works with wp_get_attachment_image_attributes

FAQ

Is it safe to allow SVG uploads with this filter alone?

No — pair it with an SVG sanitizer library or plugin. The raw filter only changes what's accepted, not what's safe.

Source: wp-includes/functions.php

Group wizard

One session: this hook, then each related_hooks entry. Walk it and tell us what to change.

upload_mimes → wp_get_attachment_image_attributes

functions.php — upload_mimes

functions.php

<?php
/**
 * Practice: hook into upload_mimes
 */
add_filter( 'upload_mimes', function( $mime_types, $user ) {
	// Write your callback here. Always return the value.

	return $mime_types;
} );

Group tour

upload_mimes · Hook 1 of 2 · Step 1 of 6

Meet upload_mimes

Filters the list of file types allowed for upload

upload_mimes controls what get_allowed_mime_types() and the uploader accept — adding a type here does not make it safe by itself; WordPress still runs its own file-content checks.

type filterphase datasince 2.0.0source wp-includes/functions.php

apply_filters( 'upload_mimes', array $mime_types, WP_User|int|null $user );

add_filter( 'upload_mimes', function( $mimes ) {
    $mimes['svg'] = 'image/svg+xml';
    return $mimes;
} );

PHP upload_mimes · Hook 1 of 2 · Step 1 of 6

Practice the upload_mimes WordPress filter hook in our interactive sandbox — a VS Code-style editor with a step-by-step upload_mimes tutorial, add_filter exercises, and instant feedback. No local WordPress install required.