MIME Types in WordPress
WordPress restricts both file types and MIME types, with additional types being added through code changes. In this article we explain what MIME types are, which MIME types WordPress allows to be uploaded, which MIME types WordPress recognizes, and how to add more MIME types if needed.
We’ll also explain why you may receive a security error when uploading an image, such as “Sorry, this file type is not permitted for security reasons” and how to fix this error.
About MIME Types
MIME stands for Multipurpose Internet Mail Extensions. MIME types are used by browsers and other internet devices to determine the type of content associated with a page. For instance, if you have a .png file and a .jpeg file on the page, the browser would know by their MIME types to treat both files as images rather than videos or some other file types.
By default, WordPress has a list of registered mime types stored in wp-includes/functions.php that any developer can call using wp_get_allowed_mime_types(). These files are the file types recognized by WordPress. However, not all MIME types recognized are allowed to be uploaded through the WordPress Admin Dashboard. To see only the types that WordPress allows to be uploaded, you can use the upload_mimes filter.
If you attempt to upload a file where either the MIME type or file type are not supported by WordPress, you will get the error “Sorry, this file type is not permitted for security reasons.” Skip ahead to learn how to fix this error.
Allowed WordPress MIME Types
Just because WordPress identifies a specific MIME type does not mean that the file type can be uploaded in your WordPress Admin Dashboard. WordPress restricts the file types that can be uploaded to the ones listed below.
Below is a list of the various file types that you can upload to WordPress, and the corresponding MIME type. These file types will upload without any security warnings in you wp-admin dashboard.
| File Extension | MIME Type |
|---|---|
| .jpg | image/jpeg, image/pjpeg |
| .jpeg | image/jpeg, image/pjpeg |
| .png | image/png |
| .gif | image/gif |
| .ico | image/x-icon |
| application/pdf | |
| .doc | application/msword |
| .docx | application/vnd.openxmlformats-officedocument.wordprocessingml.document |
| .ppt | application/mspowerpoint, application/powerpoint, application/vnd.ms-powerpoint, application/x-mspowerpoint |
| .pptx | application/vnd.openxmlformats-officedocument.presentationml.presentation |
| .pps | application/mspowerpoint, application/vnd.ms-powerpoint |
| .ppsx | application/vnd.openxmlformats-officedocument.presentationml.slideshow |
| .odt | application/vnd.oasis.opendocument.text |
| .xls | application/excel, application/vnd.ms-excel, application/x-excel, application/x-msexcel |
| .xlsx | application/vnd.openxmlformats-officedocument.spreadsheetml.sheet |
| .psd | application/octet-stream |
| .mp3 | audio/mpeg3, audio/x-mpeg-3, video/mpeg, video/x-mpeg |
| .m4a | audio/m4a |
| .ogg | audio/ogg, |
| .wav | audio/wav, audio/x-wav |
| .mp4 | video/mp4 |
| .m4v | video/x-m4v |
| .mov | video/quicktime |
| .wmv | video/x-ms-asf, video/x-ms-wmv |
| .avi | application/x-troff-msvideo, video/avi, video/msvideo, video/x-msvideo |
| .mpg | audio/mpeg, video/mpeg |
| .ogv | video/ogg |
| .3gp | video/3gpp, audio/3gpp |
| .3g2 | video/3gpp2, audio/3gpp2 |
Not Allowed WordPress MIME Types
Using the wp_get_allowed_mime_types() function will give you a list of the MIME types WordPress recognizes, but does not allow to be uploaded. Below we’ll go over the MIME types that are not allowed to be uploaded in the wp-admin, but that WordPress still recognizes.
When uploading a file using one of the following extensions you will see the security warning “Sorry, this file type is not permitted for security reasons.” Skip to this section to learn how to resolve the error.
| File Extension | MIME Type |
|---|---|
| .bmp | image/bmp |
| .tif | image/tiff |
| .tiff | image/tiff |
| .asf | video/x-ms-asf |
| .asx | video/x-ms-asf |
| .wm | video/x-ms-wm |
| .wmx | video/x-ms-wmx |
| .divx | video/divx |
| .flv | video/x-flv |
| .qt | video/quicktime |
| .mpe | video/mpeg |
| .webm | video/webm |
| .mkv | video/x-matroska |
| .txt | text/plain |
| .asc | text/plain |
| .c | text/plain |
| .cc | text/plain |
| .h | text/plain |
| .csv | text/csv |
| .tsv | text/tab-separated-values |
| .ics | text/calendar |
| .rtx | text/richtext |
| .css | text/css |
| .htm | text/html |
| .html | text/html |
| .m4b | audio/mpeg |
| .ra | audio/x-realaudio |
| .ram | audio/x-realaudio |
| .mid | audio/midi |
| .midi | audio/midi |
| .wax | audio/x-ms-wax |
| .mka | audio/x-matroska |
| .rtf | application/rtf |
| .js | application/javascript |
| .swf | application/x-shockwave-flash |
| .class | application/java |
| .tar | application/x-tar |
| .zip | application/zip |
| .gz | application/x-zip |
| .gzip | application/x-zip |
| .rar | application/rar |
| .7z | application/x-7z-compressed |
| .exe | application/x-msdownload |
| .pot | application/vnd.ms-powerpoint |
| .wri | application/vnd.ms-write |
| .xla | application/vnd.ms-excel |
| .xlt | application/vnd.ms-excel |
| .xlw | application/vnd.ms-excel |
| .mdb | application/vnd.ms-access |
| .mpp | application/vnd.ms-project |
| .docm | application/vnd.ms-word.document.macroEnabled.12 |
| .dotx | application/vnd.openxmlformats-officedocument.wordprocessingml.template |
| .dotm | application/vnd.ms-word.template.macroEnabled.12 |
| .xlsm | application/vnd.ms-excel.sheet.macroEnabled.12 |
| .xlsb | application/vnd.ms-excel.sheet.binary.macroEnabled.12 |
| .xltx | application/vnd.openxmlformats-officedocument.spreadsheetml.template |
| .xltm | application/vnd.ms-excel.template.macroEnabled.12 |
| .xlam | application/vnd.ms-excel.addin.macroEnabled.12 |
| .pptm | application/vnd.ms-powerpoint.presentation.macroEnabled.12 |
| .ppsm | application/vnd.ms-powerpoint.slideshow.macroEnabled.12 |
| .potx | application/vnd.openxmlformats-officedocument.presentationml.template |
| .potm | application/vnd.ms-powerpoint.template.macroEnabled.12 |
| .ppam | application/vnd.ms-powerpoint.addin.macroEnabled.12 |
| .sldx | application/vnd.openxmlformats-officedocument.presentationml.slide |
| .sldm | application/vnd.ms-powerpoint.slide.macroEnabled.12 |
| .onetoc | application/onenote |
| .onetoc2 | application/onenote |
| .onetmp | application/onenote |
| .onepkg | application/onenote |
| .odp | application/vnd.oasis.opendocument.presentation |
| .ods | application/vnd.oasis.opendocument.spreadsheet |
| .odg | application/vnd.oasis.opendocument.graphics |
| .odc | application/vnd.oasis.opendocument.chart |
| .odb | application/vnd.oasis.opendocument.database |
| .odf | application/vnd.oasis.opendocument.formula |
| .wp | application/wordperfect |
| .wpd | application/wordperfect |
| .key | application/vnd.apple.keynote |
| .numbers | application/vnd.apple.numbers |
| .pages | application/vnd.apple.pages |
Additional File Types
If you need to use other file types with WordPress beyond what it identifies already, it simplest to use a plugin to extend this function, for example WP Add Mime Types. Doing this is most often necessary with file types that are not images. Common examples include .epub or .mobi files from eBooks.
If you need a complete reference of which MIME types exist, see this comprehensive list.
If you’re still having issues, another potential solution is to add the following to your wp-config.php file. This allows uploading of non-image file types just for administrator-level users.
define( 'ALLOW_UNFILTERED_UPLOADS', true );To modify the wp-config file connect with either SFTP or SSH Gateway.
Non-Image File Upload Error
In the security patch for WordPress 4.7.1 which was released in January 2017, a change to the way WordPress checks the file “MIME type” for uploads was made, which may cause a security error on uploads for some file types (specifically non-image files).
Some users, especially those using custom plugins to add additional file types to the ones WordPress allows by default (found here) may experience this error when uploading to the wp-admin:
“filename” has failed to upload.
Sorry, this file type is not permitted for security reasons.
This security error is most often see with files using the extensions: .docx, .ppt, .svg, .xlsm, .ai but may display for may more file types. If you’ve just started seeing this warning you may be wondering how to fix this error. There are a couple different ways to resolve the issue:
- Add the following line to the
wp-config.phpfile. This will allow non-image uploads for administrators only:define( 'ALLOW_UNFILTERED_UPLOADS', true );- To modify the wp-config file connect with either SFTP or SSH Gateway
- Use a plugin that restores this ability, such as WP Add MIME Types
- Upload the file that is returning the error using SFTP instead
NOTE: Do NOT downgrade WordPress to fix this issue. Security patches for earlier versions of WordPress also contain this change. Downgrading will only weaken your site’s security and will not correct the error.
NEXT STEP: Using WebP for image optimization
