Upload SVG files

Upload SVG files to your media library and learn how Easy SVG Support cleans each one, which ways in are covered and why a file can be refused.

Once SVG uploads are switched on, you upload an SVG exactly like a photo. This guide shows the steps, what the plugin does to the file on the way in, and what to do when a file is refused.

Before you start

Easy SVG Support is installed and active. See Installation.
Allow SVG uploads in the media library is on under Icons → Settings.
Your user role may upload files. Administrators, editors and authors can by default.

Upload an SVG

Open the uploader

Go to Media → Add Media File. You can also add the file straight in the block editor, for example in an Image block, or as a featured image.

Choose or drop the file

Click Select Files and pick your .svg file, or drag it onto the upload area.

Let the plugin clean it

Before WordPress stores the file, Easy SVG Support sanitizes it. This takes a moment and happens without any clicks from you.

Check the result

The file appears in the media library with a preview. You can now use it anywhere you use images: in posts, galleries, as a featured image or in custom fields.

If the file cannot be cleaned, WordPress shows an error instead and nothing is stored. The questions at the end of this page explain why that happens and what to do.

What sanitizing removes

The sanitizer works with an allow-list: a list of SVG tags and attributes that are known to be harmless drawing instructions. It keeps what is on the list and removes everything else. For example:

Removed	Why
`<script>` elements	They can run code in the browser of everyone who views the file.
Event handlers such as `onload` or `onclick`	Same risk as scripts, hidden inside an attribute.
`javascript:` links	A link that runs code when clicked.
References to files, fonts or images on other servers	They can leak your visitors' data to a third party.

Shapes, paths, colors, gradients and text that form the drawing stay. In practice a logo or icon from Illustrator, Figma, Inkscape or Sketch looks the same after cleaning.

Some special effects are on purpose not on the allow-list, for example SVG animations (<animate>) and embedded HTML (<foreignObject>). A file that relies on them will look different after the upload, because those parts are removed.

Which ways of adding files are covered

Files reach WordPress in more ways than the upload button. Easy SVG Support checks all of the common ones:

Way in	What happens
Media uploader and block editor	Cleaned before it is stored
REST API (apps and other tools)	Cleaned before it is stored
WP-CLI `wp media import`	Cleaned before it is stored
`media_sideload_image()` (code that downloads an image from a URL)	Cleaned before it is stored
Importers and other code that creates attachments	Checked once more right after the attachment is created. Removed again if it cannot be cleaned.
XML-RPC (old remote publishing tools)	Accepted only when the file is already clean

The size limit

Every SVG is held to the Maximum SVG size (MB) under Icons → Settings. A file above it is refused, never cut short. The limit protects your server: a huge SVG can keep the sanitizer busy for a long time.

Most icons are a few kilobytes and most logos stay well under 1 MB. If a file is larger, it often contains an embedded photo. Exporting it again without the photo usually makes it small.

Files that were already in your library

Sanitizing happens when a file arrives. Files that were already in your media library before you installed Easy SVG Support are not checked again, and neither are files someone copied into the uploads folder by FTP.

Upload such files again to clean them, or
use the SVG cleaner in Easy SVG Pro, which finds and cleans them for you.

Good to know

Who may upload. SVG uploads need the same permission as any other media file. The plugin does not give anyone new rights.
Multisite. If your network does not list svg under Upload file types, a single site cannot allow it. Ask the network administrator.
Another plugin with an older sanitizer. If another plugin loads an outdated copy of the sanitizer library, administrators see a warning on the dashboard, the plugins screen and the media library naming that plugin. Update or deactivate it.

Common questions

There are three common reasons:

It is not a valid SVG. The file is broken or is a different format with an .svg ending. Open it in a vector editor and export it again as SVG.
It is an older Adobe Illustrator export with custom entities. Export again and choose a plain SVG without those entities (in Illustrator: File → Export → Export As → SVG).
It is larger than the size limit. Raise Maximum SVG size (MB) under Icons → Settings, or make the file smaller.

SVG cleaner (Pro)

Find and clean SVGs that skipped the uploader.

Icon library

Keep icons for the Icon block.

Developers: the allow-list, the size limit and the extra checks are documented in the developer reference.

Was this page helpful?