SVG vs PNG for WordPress
WordPress blocks SVG uploads by default for security — understanding why shapes the right strategy for using vector graphics anyway.
Why WordPress Restricts SVG by Default
WordPress's media library rejects raw SVG uploads out of the box because SVG's XML structure can embed executable scripts — a genuine XSS risk on any site accepting uploads from less-trusted users. PNG faces no such restriction, uploading and displaying immediately without any configuration changes.
- SVG's script-embedding potential is a real, deliberate security concern
- PNG uploads work immediately with zero configuration needed
- This restriction reflects genuine risk, not an arbitrary limitation
Enabling SVG Safely for the Right Use Cases
A sanitizing plugin (Safe SVG or similar) enables SVG uploads for trusted admin users while stripping dangerous script content — use SVG for the site logo, theme icons, and admin-controlled graphics this way, while continuing to use PNG/JPEG for user-submitted content or contexts where sanitization isn't in place.
- Sanitizing plugins enable safe SVG upload for trusted roles
- Logo and theme icons benefit most from enabled SVG support
- Keep PNG/JPEG as the default for less-trusted upload contexts
Frequently Asked Questions
Is it safe to just remove WordPress's SVG upload restriction entirely?
Not without a sanitizing plugin — removing the restriction without sanitization re-opens the exact XSS risk the default block exists to prevent, especially if any non-admin user has upload capability.
What's the best format for a WordPress site logo?
SVG, once safely enabled via a sanitizing plugin — it stays sharp across every screen density and theme header size, a genuine improvement over a fixed-resolution PNG logo.
Related guides
Ready to Convert Your Image to SVG?
Free online converter — no sign-up, no watermarks, results in under 3 seconds.
Convert Image to SVG — Free