23/03/2026
I’ve seen a few trusted sites suggest ALLOW_UNFILTERED_UPLOADS as the quick fix when WordPress refuses to upload a font, SVG, JSON, or some other “annoying” file type.
And yes… it works.
But this is also where WordPress security starts giving you that side-eye.
Because while it fixes your upload problem, it also chips away at one of WordPress’ built-in guardrails. What starts as:
“Ugh, I just need this font uploaded.”
Can quietly turn into:
“Well… what else can get uploaded now?”
That is the part people do not always talk about enough.
From a WordPress malware audit perspective, this constant lives in the grey zone. Helpful? Sure. Harmless? Not even close.
It is one of those settings that feels like a hero in the moment, then casually opens the door and says,
“Come on in, worms. The can is open.”
And that is my issue with it.
Because some fixes are not really fixes. They are just delayed problems wearing a helpful hat.
My take?
If the solution works by lowering a security barrier, I do not see it as a clean fix. I see it as a tradeoff. And in WordPress, those “just for now” tradeoffs have a funny way of overstaying their welcome.
