Configurator

Allow extra SVG tags and attributes that some icon libraries need, without code. Dangerous names such as script and event handlers always stay blocked.

The sanitizer keeps only SVG tags and attributes on its allow-list. That is right for almost every file. Some icon libraries, though, use an element or attribute that is not on the list, and their icons lose a detail after cleaning. The Configurator lets an administrator add such names without writing code.

Before you start

Your Pro license is active. The Configurator has no feature switch; it is always there on a licensed site.
You know exactly which tag or attribute is missing, for example from the SVG cleaner report ("Would be removed").

Every name you allow is something an uploaded file may then contain. Only add what a real icon set needs, and remove it when you no longer need it.

Allow extra names

Open the Configurator

Go to Icons → Configurator. It sits in the Security area of the menu.

Switch it on

Turn on Allow additional tags and attributes. While it is off, only the standard SVG elements are allowed.

Add tags

In Additional tags, enter one tag name per line, for example view.

Add attributes

In Additional attributes, enter one attribute name per line, for example focusable.

Check the result

Changes are saved automatically. Names that are not allowed are dropped and listed under the field with the reason, for example "Not added: script (unsafe, always refused)".

The new rules apply to every new upload and every icon you add from then on. Files that are already stored are not changed. Run the SVG cleaner scan again to see the new verdict.

What can never be allowed

These names are refused whatever you type, because they can run code or load content from elsewhere:

Kind	Names
Scripts and styles	`script`, `style`
Embedded documents	`foreignObject`, `iframe`, `embed`, `object`
Event handling	`handler`, `listener`, and every attribute starting with `on`, such as `onload`
Animation	`set`, `animate`, `animateColor`, `animateMotion`, `animateTransform`, `discard`
Links	`href`, `xlink:href`

A name with a prefix, such as s:script, is checked as well.

Good to know

Names, not values. You allow a tag or attribute by name. The sanitizer still checks every value.
Same rules everywhere. Uploads, the icon library, sets, imports and the SVG cleaner all use the widened list.
Code alternative. Developers can do the same with the esw_svg_allowed_tags and esw_svg_allowed_attributes filters.

Common questions

Upload SVG files

What the sanitizer removes by default.

SVG cleaner and repair

See what would be removed.

Developers: Sanitizer filters and the developer reference.

Was this page helpful?