How to Enable SVG Uploads in WordPress & Elementor (Complete Secure Guide)

/**
 * Allow SVG and SVGZ uploads in WordPress and Elementor
 */
function allow_svg_upload( $mimes ) {
    $mimes['svg']  = 'image/svg+xml';
    $mimes['svgz'] = 'image/svg+xml';
    return $mimes;
}
add_filter( 'upload_mimes', 'allow_svg_upload' );

/**
 * Fix SVG thumbnail display in the WordPress Media Library
 */
function fix_svg_thumbnail_display( $response ) {
    if ( $response['mime'] === 'image/svg+xml' ) {
        $response['sizes'] = array(
            'thumbnail' => array(
                'url'    => $response['url'],
                'width'  => $response['width'],
                'height' => $response['height']
            ),
            'medium' => array(
                'url'    => $response['url'],
                'width'  => $response['width'],
                'height' => $response['height']
            ),
            'large' => array(
                'url'    => $response['url'],
                'width'  => $response['width'],
                'height' => $response['height']
            ),
            'full' => array(
                'url'    => $response['url'],
                'width'  => $response['width'],
                'height' => $response['height']
            )
        );
    }
    return $response;
}
add_filter( 'wp_prepare_attachment_for_js', 'fix_svg_thumbnail_display' );

/**
 * Add basic security checks for uploaded SVG files
 */
function check_svg_security( $file ) {
    if ( $file['type'] === 'image/svg+xml' ) {
        // Read the contents of the uploaded SVG
        $content = file_get_contents( $file['tmp_name'] );
        
        // Flag potentially malicious code patterns
        $suspicious_patterns = array(
            'script',
            'onclick',
            'onload',
            'onunload',
            'onerror',
            'javascript:',
            'xlink:href',
            'data:',
            'fetch',
            'eval',
            'alert'
        );
        
        foreach ( $suspicious_patterns as $pattern ) {
            if ( stripos( $content, $pattern ) !== false ) {
                $file['error'] = 'For security reasons, this SVG file contains disallowed content.';
                break;
            }
        }
    }
    return $file;
}
add_filter( 'wp_handle_upload_prefilter', 'check_svg_security' );

/**
 * Enable dedicated SVG upload support for Elementor
 */
function elementor_allow_svg_upload($mimes) {
    return array_merge($mimes, [
        'svg'  => 'image/svg+xml',
        'svgz' => 'image/svg+xml'
    ]);
}
add_filter('elementor/files/allow_unfiltered_upload', '__return_true');
add_filter('elementor/files/svgs/allow_upload', '__return_true');
add_filter('elementor/files/svg_mime_types', 'elementor_allow_svg_upload');

/**
 * Improve SVG file type detection and handling
 */
function ensure_svg_file_safety($data, $file, $filename, $mimes) {
    // Fallback: correct MIME type when file extension is SVG but type is unrecognized
    if ( ! empty($data['ext']) && $data['ext'] === 'svg' ) {
        $data['type'] = 'image/svg+xml';
        $data['proper_filename'] = $filename;
    }
    
    return $data;
}
add_filter( 'wp_check_filetype_and_ext', 'ensure_svg_file_safety', 10, 4 );