by codeprosai 0 (0 reviews)

CodePros SVG Secure Support

Name: CodePros SVG Secure Support
Author: codeprosai

Highly secure SVG upload support for WordPress. Validates, sanitizes, and protects SVG files through a multi-layer security pipeline.

CodePros SVG Secure Support ranks #57,194 among WordPress.org plugins with 0+ active installations, is #5,571 of 6,355 in the Media category, and was last updated Jun 15, 2026. Data from WordPress.org, refreshed twice daily — see methodology.

Tested up to WP 7.0.6 (Current: 7.1.2)

v1.0.0 Current Version v1.0.0

Updated 3 months ago Last Update on 15 Jun, 2026

Refreshed 8 hours ago Last Refreshed on

#5,571 of 6,355 in Media

View on WordPress.org

Rank

#57,194

— No change

Active Installs

-100%

KW Avg Position

101

1.5 worse

Downloads

185

+1 today

Support Resolved

— No change

Rating

Review 0 out of 5

0 (0 reviews)

Next Milestone 10

Total Progress 50%

0+ 10+

11,641

Ranks to Climb

Growth Needed

8,000,000

Active Installs

Pro

Unlock Exact Install Count

See the precise estimated active installs for this plugin, calculated from real-time ranking data.

Exact install estimates within tiers
Track install growth over time
Milestone progress predictions

Upgrade to Pro

Need 5 more installs to reach 10+

Rank Changes

Current #57,194

Change

Best #

Upgrade to Pro

Unlock 30-day and 90-day rank history charts with a Pro subscription.

Upgrade Now

Active Installs Growth

Upgrade to Pro

Active Installs 0,000,000+

Growth +0.0%

Peak 0,000,000

Downloads Growth

Downloads

Growth

Peak

Upgrade to Pro

Unlock 30-day, 90-day, and yearly download history charts with a Pro subscription.

Upgrade Now

Reviews & Ratings

0.0

0 reviews

Overall 0%

0 (0%)

Track This Plugin

Get detailed analytics, keyword tracking, and position alerts delivered to your inbox.

Start Tracking Free

Plugin Details

Version: 1.0.0
Last Updated: Jun 15, 2026
Requires WP: 6.0+
Tested Up To: 7.0.6
PHP Version: 7.4 or higher
Author: codeprosai

Support & Rating

Rating: ☆ ☆ ☆ ☆ ☆ 0
Reviews: 0
Support Threads: 0
Resolved: 0%

Keywords

sanitize security SVG upload xss protection

Upgrade to Pro

Unlock keyword rankings, search positions, and detailed analytics with a Pro subscription.

Upgrade Now

Similar Plugins

Adminify – White Label, Admin Menu Editor, Login Customizer

6K+ installs

#2,758

Master Addons for Elementor – Elementor Addons, Widgets, Mega Menu Builder, Popup Builder, Widget Builder & Template Kits

30K+ installs

#1,008

Jetpack - WP Security, Backup, Speed, & Growth

3M+ installs

#18

Advanced Custom Fields (ACF®)

2M+ installs

#28

Image Optimizer – Compress Images and Convert to WebP or AVIF

Regenerate Thumbnails

1M+ installs

#64

Smush – Image Optimization, Compression, Lazy Load, WebP & CDN

1M+ installs

#65

Imagify Image Optimization: Optimize Images | Compress & Convert to WebP/AVIF

View all Media plugins

Frequently Asked Questions

Common questions about CodePros SVG Secure Support

By default, only Administrators. You can grant access to one or more additional roles (Editor, Author, Contributor, Subscriber, or any custom role) under Settings → SVG Secure Support → Roles Allowed to Upload SVGs. If no roles are selected, only Administrators can upload. All role checks are performed at upload time.

The plugin implements every layer recommended by security researchers: validation → DOM sanitization with a strict tag/attribute whitelist → string-level payload scan → Content Security Policy headers. No sanitization approach can offer an absolute guarantee, but this multi-layer pipeline eliminates all known SVG attack vectors.

It depends on where the threat is detected: Validation failures (wrong extension, wrong MIME, too large, too many nodes) — upload is blocked entirely with an error message shown to the user. Sanitizable content (disallowed tags or attributes) — the content is stripped and the cleaned SVG is accepted. Unsanitizable payloads (e.g. javascript: survives DOM traversal) — upload is blocked entirely. All outcomes are recorded in the security log.

The validation and sanitization pipeline runs only during file uploads, not on page loads. There is no frontend performance impact. The security headers are lightweight HTTP headers added on SVG attachment pages only (except X-Content-Type-Options: nosniff, which is sent on all pages).

It is strongly recommended. Without the server-level snippets, only requests routed through WordPress are protected. A direct URL to an uploaded SVG bypasses all PHP-layer security headers. Apache — applying uploads-htaccess.txt Open (or create) wp-content/uploads/.htaccess on your server. Copy the entire contents of uploads-htaccess.txt (found in the plugin directory) and append them to that file. Save. Apache picks up .htaccess changes immediately — no restart needed. Note: WordPress may overwrite uploads/.htaccess when you save Permalink settings. Re-apply the snippet after that happens, or add the directives to your main Apache VirtualHost block so they cannot be overwritten. Requires mod_headers to be enabled on your Apache installation (most managed hosts have it). The snippet also uses mod_mime, which is enabled by default. Nginx — applying uploads-nginx.conf Open your site's Nginx configuration file. On a typical Linux server this is /etc/nginx/sites-available/<your-site>.conf. In Local by Flywheel the per-site config is at ~/Local Sites/<site-name>/conf/nginx/site.conf.hbs. Copy the two location blocks from uploads-nginx.conf and paste them inside the server {} block, before the generic location / block. Reload Nginx: sudo nginx -s reload (or restart the site from the Local app).

Scenario Without snippets With snippets Direct URL to uploaded .svg No CSP, no X-Frame-Options Full security headers applied Direct URL to uploaded .php disguised as SVG PHP executes (server-dependent) 403 Forbidden WordPress attachment page for an SVG Protected by plugin PHP headers Protected by both PHP and server headers SVG served via CDN pull / hotlink No headers Server headers applied before CDN caches the response

The following event types are recorded: upload_allowed — SVG passed all checks upload_sanitized — SVG was cleaned before being saved upload_blocked — SVG was rejected tag_removed — A disallowed tag was stripped attribute_removed — A disallowed attribute was stripped suspicious_payload — A javascript: or similar payload was detected

Go to Settings → SVG Secure Support and click the Security Logs tab. You can filter by severity (Info / Warning / Critical) and event type, and purge entries older than the configured retention period.

The plugin has not been tested on WordPress Multisite. Network-wide activation is not currently supported.