MIME Types in WordPress

WordPress restricts both file types and MIME types, with new types added via code updates. In this post, we will discuss what MIME types are, which MIME types WordPress permits to be uploaded, which MIME types WordPress recognizes, and how to add new MIME types if necessary.

We’ll also discuss why you could get a security error when uploading a picture, such as “Sorry, this file type is not permitted for security reasons,” and how to resolve it.

About MIME types in WordPress

MIME types in WordPress here MIME stands for “Multipurpose Internet Mail Extensions.” Browsers and other internet devices utilize MIME types to identify the type of material on a page. For example, if you have a .png and a .jpeg file on the page, the browser will treat them as images rather than videos or other file types.

WordPress automatically stores a list of registered mime types in wp-includes/functions.php, which developers can access using wp_get_allowed_mime_types(). WordPress recognizes the following file types. However, not all MIME types recognized can be uploaded via the WordPress Admin Dashboard.

Use the upload_mimes filter to view only the sorts of files that WordPress supports for uploads.

If you try to upload a file with a MIME type or file type that WordPress does not support, you will see the error “Sorry, this file type is not permitted for security reasons.”Continue on to learn how to correct this issue.

Allowed WordPress MIME Types

Although WordPress recognizes a specific MIME type, it does not necessarily allow for uploading that file type on the Admin Dashboard. WordPress allows just the following file types to be uploaded.

The following is a list of the many file kinds that can be uploaded to WordPress, along with their matching MIME types. These file formats will upload without displaying any security warnings in your WordPress dashboard.

Not Allowed MIME types in WordPress

The wp_get_allowed_mime_types() function returns a list of MIME types that WordPress recognizes but does not allow for uploading. We’ll go over the MIME types that cannot be uploaded in wp-admin yet are recognized by WordPress.

When you upload a file with one of the following extensions, you will get the security warning: “Sorry, this file type is not permitted for security reasons.”Proceed to this section to discover how to fix the error.

Enhancing File Upload Security with WP Activity Log & Notifier

With the WP Activity Log & Notifier, you have the power to customize and restrict the types of files users can upload to your WordPress site. This feature is crucial for maintaining your site’s security and preventing malicious code from being uploaded inadvertently.

Configuration Steps

1. Navigate to the Configuration Page:
   • Go to Configuration > Advanced Site Security> in your WordPress dashboard.
2. Allowed File Types:
   • Here, you can define which MIME types are allowed for upload. You can choose from approved formats such as:
     • image/jpeg
     • image/png
     • application/pdf
     • application/zip
     • video/mp4
3. Track File Uploads for Malicious Code:
   • Activate the Allowed file type and Track File Uploads for Malicious Code option. This feature monitors all file uploads for any suspicious activity and automatically blocks any disallowed file types.
4. Adding New MIME Types:
   • If you need to add new MIME types beyond the default options, simply do so in the configuration settings. This flexibility allows you to adapt to your specific site needs while maintaining security.

Robust Protection

By implementing these restrictions, you ensure that only the selected file formats are permitted for upload. All other types will be blocked, significantly reducing the risk of harmful files being uploaded to your site. This proactive approach to file upload management not only enhances security but also builds user trust by safeguarding sensitive data.

Conclusion

In conclusion, utilizing the WP Activity Log & Notifier to set up MIME type restrictions is an essential step towards a secure WordPress environment. By carefully selecting which file types users can upload and monitoring these uploads for any suspicious activity, you create a safer site that is less vulnerable to attacks. Implement these settings today to protect your WordPress site effectively!