CodePros SVG Secure Support

FAQ

Who can upload SVG files after activation?

By default, only Administrators. You can grant access to one or more additional roles (Editor, Author, Contributor, Subscriber, or any custom role) under Settings → SVG Secure Support → Roles Allowed to Upload SVGs. If no roles are selected, only Administrators can upload. All role checks are performed at upload time.

Does this plugin make SVG uploads completely safe?

The plugin implements every layer recommended by security researchers: validation → DOM sanitization with a strict tag/attribute whitelist → string-level payload scan → Content Security Policy headers. No sanitization approach can offer an absolute guarantee, but this multi-layer pipeline eliminates all known SVG attack vectors.

What happens to a malicious SVG?

It depends on where the threat is detected:

• Validation failures (wrong extension, wrong MIME, too large, too many nodes) — upload is blocked entirely with an error message shown to the user.
• Sanitizable content (disallowed tags or attributes) — the content is stripped and the cleaned SVG is accepted.
• Unsanitizable payloads (e.g. javascript: survives DOM traversal) — upload is blocked entirely.

All outcomes are recorded in the security log.

Will this slow down my site?

The validation and sanitization pipeline runs only during file uploads, not on page loads. There is no frontend performance impact. The security headers are lightweight HTTP headers added on SVG attachment pages only (except X-Content-Type-Options: nosniff, which is sent on all pages).

Do I need to configure Apache or Nginx separately?

It is strongly recommended. Without the server-level snippets, only requests routed through WordPress are protected. A direct URL to an uploaded SVG bypasses all PHP-layer security headers.

Apache — applying uploads-htaccess.txt

1. Open (or create) wp-content/uploads/.htaccess on your server.
2. Copy the entire contents of uploads-htaccess.txt (found in the plugin directory) and append them to that file.
3. Save. Apache picks up .htaccess changes immediately — no restart needed.
4. Note: WordPress may overwrite uploads/.htaccess when you save Permalink settings. Re-apply the snippet after that happens, or add the directives to your main Apache VirtualHost block so they cannot be overwritten.

Requires mod_headers to be enabled on your Apache installation (most managed hosts have it). The snippet also uses mod_mime, which is enabled by default.

Nginx — applying uploads-nginx.conf

1. Open your site’s Nginx configuration file. On a typical Linux server this is /etc/nginx/sites-available/<your-site>.conf. In Local by Flywheel the per-site config is at ~/Local Sites/<site-name>/conf/nginx/site.conf.hbs.
2. Copy the two location blocks from uploads-nginx.conf and paste them inside the server {} block, before the generic location / block.
3. Reload Nginx: sudo nginx -s reload (or restart the site from the Local app).

What changes when you apply these files

Scenario
Without snippets
With snippets

Direct URL to uploaded .svg
No CSP, no X-Frame-Options
Full security headers applied

Direct URL to uploaded .php disguised as SVG
PHP executes (server-dependent)
403 Forbidden

WordPress attachment page for an SVG
Protected by plugin PHP headers
Protected by both PHP and server headers

SVG served via CDN pull / hotlink
No headers
Server headers applied before CDN caches the response

What is logged?

The following event types are recorded:

• upload_allowed — SVG passed all checks
• upload_sanitized — SVG was cleaned before being saved
• upload_blocked — SVG was rejected
• tag_removed — A disallowed tag was stripped
• attribute_removed — A disallowed attribute was stripped
• suspicious_payload — A javascript: or similar payload was detected

How do I view and manage logs?

Go to Settings → SVG Secure Support and click the Security Logs tab. You can filter by severity (Info / Warning / Critical) and event type, and purge entries older than the configured retention period.

Does the plugin work with Multisite?

The plugin has not been tested on WordPress Multisite. Network-wide activation is not currently supported.