Teemu Suoranta

<p>Converts Cyrillic, Georgian, Arabic and Chinese characters in post, term slugs and media file names to Latin characters.</p>
<p>This plugins uses parts from following plugins:</p>
<ul>
<li><a href="https://wordpress.org/plugins/arabic-to-lat/" rel="ugc">Arabic-to-latino</a></li>
<li><a href="https://wordpress.org/plugins/cyr3lat/" rel="ugc">Cyr to Lat enhanced</a></li>
<li><a href="https://wordpress.org/plugins/so-pinyin-slugs/" rel="ugc">Pinyin Slugs</a></li>
</ul>
<h4>The problem</h4>
<p>WordPress cannot sanitize all languages correctly which leaves pretty permalink with bare post ID. There are a few separate plugins to handle sanitazing but they won’t generally play along nicley and end up often removing parts from other languages.</p>
<h4>The solution</h4>
<p>This plugins combines the few working slug sanitazing plugins so that they will work together.</p>
<p>If you need only one of above plugins, you can (and probably should) use them instead of this. If you are in need of multiple of these plugins, this is the conflict-free combination for you.</p>
<h4>What this plugin sanitizes?</h4>
<ul>
<li>Post slug</li>
<li>Term slug</li>
<li>Filename</li>
</ul>
<p>These are sanitized with WordPress’s filter and done in post save etc.</p>
<p><strong>Notice:</strong> There is no bulk sanitizing option right now. If you are in need of it, some of the plugins above have their own solutions so adding the feature here wouldn’t be such a big hassle. Send a PR!</p>
<h4>What about language X?</h4>
<p>Send PR to add other languages to the mix.</p>


Aucor URL Sanitizer

Converts Cyrillic, Georgian, Arabic and Chinese characters in post, term slugs and media file names to Latin characters.

codeprosai

<p>WordPress does not support SVG uploads natively — and naive SVG plugins are a well-known attack surface. SVG files are XML documents that can carry XSS payloads, XXE attacks, external resource injection, and embedded HTML. <strong>CodePros SVG Secure Support</strong> adds safe, production-ready SVG uploads through a layered defense pipeline.</p>
<h4>Security Pipeline</h4>
<p>Every uploaded SVG passes through five sequential checks before it is accepted:</p>
<ol>
<li><strong>Extension check</strong> — Blocks double-extension filenames (e.g. <code>payload.php.svg</code>) and enforces <code>.svg</code> only.</li>
<li><strong>MIME check</strong> — Verifies actual file bytes return <code>image/svg+xml</code> via <code>finfo</code>; confirms <code><svg</code> or <code><?xml</code> is present in the header bytes.</li>
<li><strong>Size check</strong> — Rejects files exceeding the configured maximum (default 1 MB).</li>
<li><strong>Node-count check</strong> — Parses the XML and counts DOM nodes; rejects files above the threshold (default 5,000 nodes) to prevent node-flood DoS attacks.</li>
<li><strong>Dimension check</strong> — Reads the root <code><svg></code> width/height/viewBox; rejects unreasonably large declared dimensions (default 10,000 px).</li>
</ol>
<p>After validation, the file is sanitized:</p>
<ul>
<li>DOM sanitization via the battle-tested <strong>enshrined/svg-sanitize</strong> library with custom tag and attribute whitelists.</li>
<li>Remote reference stripping — all external URLs are removed.</li>
<li>Final string-level regex scan for <code>javascript:</code>, <code><script</code>, inline event handlers (<code>on*=</code>), and CSS <code>expression()</code> — any match causes the upload to be rejected entirely.</li>
</ul>
<h4>Security Headers</h4>
<p>When SVG attachment pages are served, the plugin adds:</p>
<ul>
<li><code>Content-Security-Policy</code> (configurable, secure default provided)</li>
<li><code>X-Content-Type-Options: nosniff</code></li>
<li><code>X-Frame-Options: SAMEORIGIN</code></li>
</ul>
<h4>Server-Level Hardening (Optional but Recommended)</h4>
<p>The plugin’s PHP layer covers every SVG upload that passes through WordPress. But if someone accesses an uploaded file directly — e.g. by visiting <code>https://example.com/wp-content/uploads/2024/01/logo.svg</code> — WordPress is bypassed entirely, so the PHP security headers are never sent.</p>
<p>The plugin ships two ready-to-use server configuration snippets to close that gap:</p>
<ul>
<li><strong><code>uploads-htaccess.txt</code></strong> — for Apache / LiteSpeed servers</li>
<li><strong><code>uploads-nginx.conf</code></strong> — for Nginx servers</li>
</ul>
<p>Each snippet does three things:</p>
<ol>
<li><strong>Blocks server-side script execution</strong> in <code>wp-content/uploads/</code> — if an attacker somehow uploads a <code>.php</code> file and tries to access it directly, the server returns 403 instead of executing it.</li>
<li><strong>Enforces the correct SVG MIME type</strong> (<code>image/svg+xml</code>) — some server setups serve SVGs as <code>text/plain</code>, which prevents browsers from honouring Content Security Policy rules scoped to that MIME type.</li>
<li><strong>Adds security headers on direct SVG requests</strong> — the same <code>X-Content-Type-Options</code>, <code>X-Frame-Options</code>, and <code>Content-Security-Policy</code> headers that the PHP layer adds on WordPress attachment pages, so direct file links are equally protected.</li>
</ol>
<p>Applying these snippets is the difference between WordPress-mediated access being protected and <em>all</em> access (direct URL, CDN pull, hotlink) being protected.</p>
<h4>Admin UI</h4>
<p>A tabbed settings page under <strong>Settings <span aria-hidden="true" class="wp-exclude-emoji">→</span> SVG Secure Support</strong> provides:</p>
<ul>
<li><strong>Settings tab</strong> — Configure allowed upload roles, file size/node/dimension limits, sanitization options, CSP header value, and logging preferences.</li>
<li><strong>Security Logs tab</strong> — Paginated, filterable log viewer showing every security event (blocked upload, removed tag/attribute, suspicious payload). Includes a log purge action.</li>
</ul>
<h4>Key Features</h4>
<ul>
<li>Role-based upload access — select one or more WordPress roles (default: Administrator) whose members may upload SVG files</li>
<li>Automatic upload-time sanitization — clean SVG replaces the original tmp file before WordPress moves it</li>
<li>Security event logging to the WordPress debug log and a dedicated database table</li>
<li>Configurable log retention with one-click purge</li>
<li>Bundled <code>.htaccess</code> and Nginx config snippets for the uploads directory</li>
</ul>


CodePros SVG Secure Support

Highly secure SVG upload support for WordPress. Validates, sanitizes, and protects SVG files through a multi-layer security pipeline.

Aucor URL Sanitizer vs CodePros SVG Secure Support