by
codeprosai
0 (0 reviews)
CodePros SVG Secure Support
Highly secure SVG upload support for WordPress. Validates, sanitizes, and protects SVG files through a multi-layer security pipeline.
CodePros SVG Secure Support ranks #62,085 among WordPress.org plugins with 0+ active installations, and was last updated Jun 15, 2026. Data from WordPress.org, refreshed twice daily — see methodology.
Compatible with WP 7.0.2
v1.0.0
Current Version v1.0.0
Updated 1 month ago
Last Update on 15 Jun, 2026
Refreshed 15 hours ago
Last Refreshed on
Rank
#62,085
-7249 this week
Active Installs
0+
-2%
KW Avg Position
97.5
+0.5 better
Downloads
96
—
Total downloads
Support Resolved
0%
—
No change
Rating
0%
Review 0 out of 5
0
(0 reviews)
Next Milestone 10
0+
10+
31,269
Ranks to Climb
-
Growth Needed
8,000,000
Active Installs
Pro
Unlock Exact Install Count
See the precise estimated active installs for this plugin, calculated from real-time ranking data.
- Exact install estimates within tiers
- Track install growth over time
- Milestone progress predictions
Need 10 more installs to reach 10+
Rank Changes
Current
#62,085
Change
Best
#
Downloads Growth
Downloads
Growth
Peak
Upgrade to Pro
Unlock 30-day, 90-day, and yearly download history charts with a Pro subscription.
Upgrade NowReviews & Ratings
0.0
0 reviews
Overall
0%
5
0
(0%)
4
0
(0%)
3
0
(0%)
2
0
(0%)
1
0
(0%)
Tracked Keywords
Showing 2 of 2| Keyword | Position | Change | Type | Updated |
|---|---|---|---|---|
| sanitize | 38 | — | Tag | 1 day ago |
| xss protection | 157 | — | Tag | 1 day ago |
Unlock Keyword Analytics
Track keyword rankings, search positions, and discover new ranking opportunities with a Pro subscription.
- Full keyword position tracking
- Historical ranking data
- Competitor keyword analysis
Track This Plugin
Get detailed analytics, keyword tracking, and position alerts delivered to your inbox.
Start Tracking FreePlugin Details
- Version
- 1.0.0
- Last Updated
- Jun 15, 2026
- Requires WP
- 6.0+
- Tested Up To
- 7.0.2
- PHP Version
- 7.4 or higher
- Author
- codeprosai
Support & Rating
- Rating
- ☆ ☆ ☆ ☆ ☆ 0
- Reviews
- 0
- Support Threads
- 0
- Resolved
- 0%
Keywords
Upgrade to Pro
Unlock keyword rankings, search positions, and detailed analytics with a Pro subscription.
Upgrade NowSimilar Plugins
Adminify – White Label, Admin Menu Editor, Login Customizer
7K+ installs
#2,721
Master Addons for Elementor – Elementor Addons, Widgets, Mega Menu Builder, Popup Builder, Widget Builder & Template Kits
30K+ installs
#989
Jetpack - WP Security, Backup, Speed, & Growth
3M+ installs
#18
Advanced Custom Fields (ACF®)
2M+ installs
#28
Image Optimization – Compress Images and Convert to WebP or AVIF
1M+ installs
#60
EWWW Image Optimizer
1M+ installs
#62
Smush – Image Optimization, Compression, Lazy Load, WebP & CDN
1M+ installs
#64
Regenerate Thumbnails
1M+ installs
#65
Imagify Image Optimization: Optimize Images | Compress & Convert to WebP/AVIF
1M+ installs
#67
Smart Slider 3
800K+ installs
#78
Frequently Asked Questions
Common questions about CodePros SVG Secure Support
By default, only Administrators. You can grant access to one or more additional roles (Editor, Author, Contributor, Subscriber, or any custom role) under Settings → SVG Secure Support → Roles Allowed to Upload SVGs. If no roles are selected, only Administrators can upload. All role checks are performed at upload time.
The plugin implements every layer recommended by security researchers: validation → DOM sanitization with a strict tag/attribute whitelist → string-level payload scan → Content Security Policy headers. No sanitization approach can offer an absolute guarantee, but this multi-layer pipeline eliminates all known SVG attack vectors.
It depends on where the threat is detected: Validation failures (wrong extension, wrong MIME, too large, too many nodes) — upload is blocked entirely with an error message shown to the user. Sanitizable content (disallowed tags or attributes) — the content is stripped and the cleaned SVG is accepted. Unsanitizable payloads (e.g. javascript: survives DOM traversal) — upload is blocked entirely. All outcomes are recorded in the security log.
The validation and sanitization pipeline runs only during file uploads, not on page loads. There is no frontend performance impact. The security headers are lightweight HTTP headers added on SVG attachment pages only (except X-Content-Type-Options: nosniff, which is sent on all pages).
It is strongly recommended. Without the server-level snippets, only requests routed through WordPress are protected. A direct URL to an uploaded SVG bypasses all PHP-layer security headers. Apache — applying uploads-htaccess.txt Open (or create) wp-content/uploads/.htaccess on your server. Copy the entire contents of uploads-htaccess.txt (found in the plugin directory) and append them to that file. Save. Apache picks up .htaccess changes immediately — no restart needed. Note: WordPress may overwrite uploads/.htaccess when you save Permalink settings. Re-apply the snippet after that happens, or add the directives to your main Apache VirtualHost block so they cannot be overwritten. Requires mod_headers to be enabled on your Apache installation (most managed hosts have it). The snippet also uses mod_mime, which is enabled by default. Nginx — applying uploads-nginx.conf Open your site's Nginx configuration file. On a typical Linux server this is /etc/nginx/sites-available/<your-site>.conf. In Local by Flywheel the per-site config is at ~/Local Sites/<site-name>/conf/nginx/site.conf.hbs. Copy the two location blocks from uploads-nginx.conf and paste them inside the server {} block, before the generic location / block. Reload Nginx: sudo nginx -s reload (or restart the site from the Local app).
Scenario Without snippets With snippets Direct URL to uploaded .svg No CSP, no X-Frame-Options Full security headers applied Direct URL to uploaded .php disguised as SVG PHP executes (server-dependent) 403 Forbidden WordPress attachment page for an SVG Protected by plugin PHP headers Protected by both PHP and server headers SVG served via CDN pull / hotlink No headers Server headers applied before CDN caches the response
The following event types are recorded: upload_allowed — SVG passed all checks upload_sanitized — SVG was cleaned before being saved upload_blocked — SVG was rejected tag_removed — A disallowed tag was stripped attribute_removed — A disallowed attribute was stripped suspicious_payload — A javascript: or similar payload was detected
Go to Settings → SVG Secure Support and click the Security Logs tab. You can filter by severity (Info / Warning / Critical) and event type, and purge entries older than the configured retention period.
The plugin has not been tested on WordPress Multisite. Network-wide activation is not currently supported.