Description
Developersd Manage Media Support is an advanced media management plugin that gives administrators precise control over what can be uploaded to their WordPress site — far beyond the handful of file types WordPress supports out of the box.
Enable support for SVG, WebP, AVIF, HEIC, fonts, PDFs, Office documents, archives, developer files (JSON, YAML, SQL, Markdown), audio/video, certificates, contact cards, and design files (Figma, Sketch, Adobe XD) — or register your own custom MIME types entirely.
Key Features
- Enable or disable dozens of built-in file types across nine categories: Images, Fonts, Documents, Archives, Development Files, Media, Certificates, Contacts, and Design.
- Register unlimited custom MIME types with your own extension, MIME string, and description.
- Strict MIME validation using WordPress core’s own file inspection — never trusts the browser-supplied content type alone.
- Optional magic-byte (file signature) checking to catch files renamed to bypass extension-based filters.
- Built-in, dependency-free SVG sanitizer that strips scripts, event handlers, and other XSS vectors before an SVG is stored.
- Configurable maximum upload size, with automatic detection of your server’s real
upload_max_filesize/post_max_sizelimits and a clear warning when your setting exceeds what the server allows. - Copy-paste
.htaccessandphp.inisnippets for hosts that support raising those limits. - Per-role upload permissions, so you can allow SVG uploads for Administrators while blocking them for Authors, for example.
- One-click preset profiles for common site types: Developer, Designer/Agency, Media Site, Business Website, and Educational.
- Import, export, and reset settings as JSON.
- Optional local upload audit log (who uploaded what, when, and whether it was allowed).
- Live Upload Tester — check whether a file would be accepted without adding it to the Media Library.
- System compatibility page showing PHP/WordPress versions and required extensions.
- Full multisite compatibility.
- Developer filters and actions for extending the plugin (
devds_mime_catalog,devds_presets,devds_default_settings, and more). - Zero tracking. Zero telemetry. Zero external requests. Everything runs locally on your site.
Security First
Every uploaded file is checked against the extensions and MIME types you’ve explicitly enabled, validated against WordPress’s own file-type detection, and optionally checked against known file signatures. SVG uploads are sanitized by default when enabled. Nothing here ever relies on trusting a browser-supplied filename or content type.
Developer Friendly
The plugin is built with a clean, fully namespaced, object-oriented architecture. Every class has a single responsibility, all settings live in a single option (no custom database tables), and a full set of filters and actions lets other plugins register additional MIME types or adjust behavior without editing core files.
Installation
- Upload the
developersd-manage-media-supportfolder to the/wp-content/plugins/directory, or install directly through the WordPress Plugins screen. - Activate the plugin through the “Plugins” screen in WordPress.
- Go to Settings Media Support to configure which file types are allowed and set your upload limits.
FAQ
-
Will this let me exceed my host’s upload size limit?
-
No. The plugin enforces whichever is smaller: your configured maximum, or your server’s actual PHP
upload_max_filesize/post_max_sizevalues. It will clearly warn you if your configured value exceeds what the server allows, and provides optional.htaccess/php.inisnippets you can try — but ultimately your hosting provider controls those hard limits. -
Is SVG upload safe?
-
SVG support is disabled by default. When you enable it, the plugin sanitizes every uploaded SVG file — stripping scripts, event handler attributes, external references, and other known XSS vectors — using a dependency-free sanitizer built on PHP’s DOMDocument. For maximum safety, we also recommend restricting SVG uploads to trusted roles using the Upload Limits tab.
-
Does this plugin track anything or phone home?
-
No. This plugin makes no external requests, collects no user data, and includes no analytics or tracking of any kind.
-
What happens to my settings if I deactivate the plugin?
-
Nothing — deactivating leaves all settings intact. Settings and the audit log are only removed on uninstall (deleting the plugin), and only if you’ve explicitly enabled “Delete data on uninstall” in the Advanced tab.
-
Can other plugins register their own file types?
-
Yes. Use the
devds_mime_catalogfilter to add entire new groups or individual file types programmatically.
Reviews
There are no reviews for this plugin.
Contributors & Developers
“Developersd Manage Media Support” is open source software. The following people have contributed to this plugin.
Contributors
Translate “Developersd Manage Media Support” into your language.
Interested in development?
Browse the code, check out the SVN repository, or subscribe to the development log by RSS.
Changelog
1.1.3
- Fixed: the denylist of disallowed custom-type extensions was incomplete — css, xsl/xslt, svgz (gzip-compressed SVG, which bypasses the SVG sanitizer), wasm, swf, and class have been added alongside the existing script/executable entries.
1.1.2
- Fixed: removed .phpcs.xml.dist from the distributed package — WordPress.org’s packaging scanner disallows hidden/dot files and dev-tooling config files in the submitted plugin ZIP entirely. The underlying naming-convention fixes (inline phpcs:disable comments in the actual PHP files) don’t depend on this file, so nothing else changes.
1.1.1
- Fixed: uninstall.php’s multisite loop now runs inside its own function instead of at file top-level, so its working variables are no longer flagged as unprefixed globals.
- Fixed: added documented, targeted suppressions for a PHPCS naming-convention sniff that flagged this plugin’s PHP namespace (
Developersd\MediaSupport) as an unrecognized global prefix, and flagged template-partial local variables as if they were globals (they’re alwaysinclude()d from within a class method, so they’re not). - Added: a
.phpcs.xml.distruleset declaring this plugin’s recognized prefixes, for anyone running PHPCS/WPCS directly against the codebase.
1.1.0
- Security: added a hard denylist of server- and browser-executable extensions (php and variants, js, html/htm, htaccess, sh, exe, and similar) that can never be enabled, whether via the built-in catalog, a custom type, or a settings import — closing a gap where the Custom File Types feature had no restriction on what an admin could register.
- Changed: all previously generic
dms-prefixed identifiers (constants, hooks/filters, option names, the AJAX action, the nonce, and the enqueued script/style handle) have been renamed to thedevds/DEVDSprefix, per WordPress.org Plugin Directory review feedback that the original prefix was too short. This includes thedevds_settingsanddevds_audit_logoptions (previouslydms_settings/dms_audit_log) — sites that saved settings under the old prefix will start fresh with defaults after updating.
1.0.3
- Fixed: replaced direct unlink() calls with wp_delete_file(), per WordPress Plugin Check.
- Fixed: replaced direct fopen()/fread()/fclose() calls in the magic-byte signature check with a bounded file_get_contents() read.
- Fixed: added documented nonce/sanitization annotations where Plugin Check couldn’t trace verification performed in a separate method, and reviewed each flagged case individually.
- Removed: the manual load_plugin_textdomain() call — WordPress 4.6+ auto-loads translations for plugins whose text domain matches their slug, so this was both unnecessary and flagged as discouraged.
- Fixed: readme.txt “Tested up to” updated to the current WordPress version, and the short description trimmed to fit WordPress.org’s 150-character limit.
1.0.2
- Fixed: uploads of file types WordPress core already supports by default (JPG, PNG, GIF, ZIP, and dozens more) were being blocked with “disabled by the site administrator”, because validation only consulted this plugin’s own catalog instead of WordPress’s actual accepted-types list.
- Fixed: custom file types added on the File Types tab had no way to actually take effect — they’re now active as soon as they’re added.
- Fixed: saving one settings tab (e.g. General) could silently reset settings that live on a different tab (e.g. File Types, Upload Limits) back to empty/default, because each tab’s form only submits its own fields. Saving is now scoped per tab.
- Changed: default enabled file types are now computed from WordPress core’s actual mime whitelist at runtime (jpg, png, gif, pdf, zip, docx, mp3, etc. default ON; SVG, fonts, PSD, JSON, and similar higher-risk formats default OFF), rather than a hard-coded guess.
1.0.1
- Fixed: saving settings on a non-General tab redirected back to the General tab instead of staying put.
- Fixed: a duplicate “Settings saved” notice appeared alongside the toast message.
- Improved: success/error messages now render as a floating toast appended to the page body, ensuring correct positioning above the admin bar with no visual overlap with the plugin’s own header.
- Added: a “Settings” link on the Plugins list screen.
1.0.0
- Initial release.