SVG settings

WordPress blocks SVG uploads by default, because an SVG file can carry script. Plathix gives the site one SVG policy, a list of roles allowed to upload SVG and an optional strict safe mode. The policy is active from the moment the plugin is installed: Administrator and Editor can upload SVG, and Plathix cleans each SVG uploaded through the Media Library, the media window or Replace file.

When you need this

• A brand kit in SVG. A designer uploads logos and icons to Brand › Logos and Brand › Icons. The default policy accepts them for Administrator and Editor and cleans each file.
• A site with outside authors. Keep SVG for trusted roles only, or turn on strict safe mode so that files with external references or style blocks are refused.
• Another SVG plugin is already in place. Choose Do not manage SVG so that Plathix leaves normal uploads to that plugin.

How to choose the SVG policy

1. Open Plathix → Settings → SVG.
2. Under SVG Uploads, pick one of the three options.
3. Click Save Settings. The badge “✓ Saved!” confirms the save.

The description reads “Choose how Plathix handles .svg uploads across the whole site.”

What cleaning removes. Under the Allow policy, Plathix cleans each SVG uploaded through the Media Library, the media window or Replace file before WordPress stores it. It removes scripts, event attributes such as onload and onclick, embedded web content and links to external resources, also inside CSS. It also removes some animation elements, so check animated SVG files after the upload. References to elements inside the same file, such as #id, stay. The uploader is not told what was removed.

How to choose who can upload SVG

1. Open Plathix → Settings → SVG.
2. Check that SVG Uploads is set to Allow SVG uploads with sanitisation (recommended). With the other two policies, the role list is hidden.
3. Under SVG Allowed Roles, check the roles that may upload SVG.
4. Click Save Settings.

The description reads “Select which roles are permitted to upload SVG files.” There is one checkbox per WordPress role. The default is Administrator and Editor.

A user can upload SVG only if all three are true:

• the user can upload files in WordPress;
• the user has the Plathix access level Upload or Full;
• the user’s role is checked in this list.

If you clear every box, nobody can upload SVG, administrators included. Contributor cannot upload SVG even when checked, because WordPress does not let that role upload files. A Subscriber is stopped by WordPress before the SVG check. With PRO active and licensed, a per-user override on the user profile can allow a user whose role is not listed, see PRO. Use the PRO version released for your Plathix version.

On multisite, with the Allow policy selected, the tab shows Multisite notice: “SVG upload is enabled network-wide. Each sub-site’s allowed role list applies independently. Consider restricting to Administrator only on untrusted sites.”

How to turn on strict safe mode

1. Open Plathix → Settings → SVG. The policy must be Allow SVG uploads with sanitisation (recommended).
2. Under SVG Safe Mode, check Enable strict safe mode.
3. Click Save Settings.

The description reads “Strips more aggressively — rejects uploads where <use> or <image> elements reference external resources. Recommended for sites with untrusted editors.” The text under the checkbox reads “More restrictive sanitisation. May affect complex SVG animations.” The default is off on a single site and on for multisite.

Strict mode does not remove more parts. It refuses the whole file in these cases:

• a <use> element points to anything other than an element inside the same file;
• a <use> or <image> element links to a web address, a script or embedded data;
• a <style> or <foreignObject> element is still in the file after cleaning.

Many design tool exports keep their styles in <style>, so expect rejections.

How to find out why an SVG was rejected

1. Read the message that the uploader shows next to the file.
2. Find the message in the table below.
3. For details, ask your host for the PHP error log. Plathix writes its own rejections there, not the WordPress refusal under Block.

This table covers uploads to the Media Library and through the media window.

When many files are rejected within a short time, not every rejection is logged. In Free there is no admin screen for rejections. With PRO active and licensed, the same entries also appear in the Audit Log.

Example

Suppose your blog uses the Blog & Content tree with the default SVG policy, and SVG Allowed Roles has Administrator and Editor checked.

1. An author uploads icon-cart.svg to Brand › Icons. The upload would fail with “You are not allowed to upload SVG files.”
2. The administrator opens Plathix → Settings → SVG, checks Author under SVG Allowed Roles and clicks Save Settings.
3. The author uploads icon-cart.svg again. It would be accepted. Its onclick attribute would be removed, and its <style> block would stay.
4. The administrator checks Enable strict safe mode and saves.
5. The author uploads logo.svg, which also has a <style> block, to Brand › Logos. The upload would fail with “SVG file contains unsafe content and was rejected.”

Result: authors could upload SVG, and in strict mode uploads through the Media Library would accept only files without <style> and external references. icon-cart.svg would stay in the library as it was saved, because Plathix does not rescan existing files.

What we tested

Limits

• The size limit is 2 MB. There is no setting for it.
• Changing the policy or strict mode never rescans, cleans or deletes files already in the library. There is no rescan tool.
• Under Block, existing SVG files stay and their URLs keep working. In the Lab test they still displayed. Theme or plugin output that relies on WordPress image functions, such as featured images and logos, may stop showing them, because the Plathix SVG image fallback is active only under Allow.
• Strict safe mode rejects every <style> block, including harmless ones.
• A successful upload does not report what was removed.
• In Free, rejections go only to the PHP error log. When many files are rejected within a short time, not every rejection is logged. With PRO active and licensed, the same entries also appear in the Audit Log. Refusals by WordPress under Block are not logged by Plathix.
• Replace Media. Under Allow, Replace cleans an SVG and applies the role list, the 2 MB limit and strict safe mode. Under Block, an SVG cannot be used as a replacement (“Uploaded file type is not allowed.”). Under Do not manage SVG, Replace accepts an SVG only if another plugin allows SVG, and Plathix then still cleans it and applies its own role list, the 2 MB limit and strict safe mode. See Replace a media file.

In short

Plathix allows SVG from installation on, for Administrator and Editor, and cleans every SVG uploaded through the Media Library, the media window or Replace file. You can block SVG for the whole site or leave it to another plugin. A user needs WordPress permission to upload files, Plathix level Upload or Full, and a checked role. Strict safe mode refuses whole files with external references or <style> blocks. Existing files are never rescanned.