Highly secure SVG upload support for WordPress. Validates, sanitizes, and protects SVG files through a multi-layer security pipeline.

Terry L.

WP Shieldon – WordPress Firewall

WP Shieldon is a WordPress security plugin based on Shieldon library, a Web Application Firewall (WAF) for PHP.

kennethrapp

The Law

Sanitize post markup and provide xss protection with htmLawed

codeprosai

<p>WordPress does not support SVG uploads natively — and naive SVG plugins are a well-known attack surface. SVG files are XML documents that can carry XSS payloads, XXE attacks, external resource injection, and embedded HTML. <strong>CodePros SVG Secure Support</strong> adds safe, production-ready SVG uploads through a layered defense pipeline.</p>
<h4>Security Pipeline</h4>
<p>Every uploaded SVG passes through five sequential checks before it is accepted:</p>
<ol>
<li><strong>Extension check</strong> — Blocks double-extension filenames (e.g. <code>payload.php.svg</code>) and enforces <code>.svg</code> only.</li>
<li><strong>MIME check</strong> — Verifies actual file bytes return <code>image/svg+xml</code> via <code>finfo</code>; confirms <code><svg</code> or <code><?xml</code> is present in the header bytes.</li>
<li><strong>Size check</strong> — Rejects files exceeding the configured maximum (default 1 MB).</li>
<li><strong>Node-count check</strong> — Parses the XML and counts DOM nodes; rejects files above the threshold (default 5,000 nodes) to prevent node-flood DoS attacks.</li>
<li><strong>Dimension check</strong> — Reads the root <code><svg></code> width/height/viewBox; rejects unreasonably large declared dimensions (default 10,000 px).</li>
</ol>
<p>After validation, the file is sanitized:</p>
<ul>
<li>DOM sanitization via the battle-tested <strong>enshrined/svg-sanitize</strong> library with custom tag and attribute whitelists.</li>
<li>Remote reference stripping — all external URLs are removed.</li>
<li>Final string-level regex scan for <code>javascript:</code>, <code><script</code>, inline event handlers (<code>on*=</code>), and CSS <code>expression()</code> — any match causes the upload to be rejected entirely.</li>
</ul>
<h4>Security Headers</h4>
<p>When SVG attachment pages are served, the plugin adds:</p>
<ul>
<li><code>Content-Security-Policy</code> (configurable, secure default provided)</li>
<li><code>X-Content-Type-Options: nosniff</code></li>
<li><code>X-Frame-Options: SAMEORIGIN</code></li>
</ul>
<h4>Server-Level Hardening (Optional but Recommended)</h4>
<p>The plugin’s PHP layer covers every SVG upload that passes through WordPress. But if someone accesses an uploaded file directly — e.g. by visiting <code>https://example.com/wp-content/uploads/2024/01/logo.svg</code> — WordPress is bypassed entirely, so the PHP security headers are never sent.</p>
<p>The plugin ships two ready-to-use server configuration snippets to close that gap:</p>
<ul>
<li><strong><code>uploads-htaccess.txt</code></strong> — for Apache / LiteSpeed servers</li>
<li><strong><code>uploads-nginx.conf</code></strong> — for Nginx servers</li>
</ul>
<p>Each snippet does three things:</p>
<ol>
<li><strong>Blocks server-side script execution</strong> in <code>wp-content/uploads/</code> — if an attacker somehow uploads a <code>.php</code> file and tries to access it directly, the server returns 403 instead of executing it.</li>
<li><strong>Enforces the correct SVG MIME type</strong> (<code>image/svg+xml</code>) — some server setups serve SVGs as <code>text/plain</code>, which prevents browsers from honouring Content Security Policy rules scoped to that MIME type.</li>
<li><strong>Adds security headers on direct SVG requests</strong> — the same <code>X-Content-Type-Options</code>, <code>X-Frame-Options</code>, and <code>Content-Security-Policy</code> headers that the PHP layer adds on WordPress attachment pages, so direct file links are equally protected.</li>
</ol>
<p>Applying these snippets is the difference between WordPress-mediated access being protected and <em>all</em> access (direct URL, CDN pull, hotlink) being protected.</p>
<h4>Admin UI</h4>
<p>A tabbed settings page under <strong>Settings <span aria-hidden="true" class="wp-exclude-emoji">→</span> SVG Secure Support</strong> provides:</p>
<ul>
<li><strong>Settings tab</strong> — Configure allowed upload roles, file size/node/dimension limits, sanitization options, CSP header value, and logging preferences.</li>
<li><strong>Security Logs tab</strong> — Paginated, filterable log viewer showing every security event (blocked upload, removed tag/attribute, suspicious payload). Includes a log purge action.</li>
</ul>
<h4>Key Features</h4>
<ul>
<li>Role-based upload access — select one or more WordPress roles (default: Administrator) whose members may upload SVG files</li>
<li>Automatic upload-time sanitization — clean SVG replaces the original tmp file before WordPress moves it</li>
<li>Security event logging to the WordPress debug log and a dedicated database table</li>
<li>Configurable log retention with one-click purge</li>
<li>Bundled <code>.htaccess</code> and Nginx config snippets for the uploads directory</li>
</ul>


Alternatives to CodePros SVG Secure Support

Top alternatives