How To Restrict SVG and Code Uploads With BetterShield?

2 min read

Accounts below administrator can no longer upload SVG, HTML, JavaScript or PHP-type files.

With BetterShield, accounts below administrator can no longer upload SVG, HTML, JavaScript or PHP-type files.

What it does

Admin-only SVG and code uploads is under BetterShield › Protection › Hardening. Accounts below administrator can no longer upload SVG, HTML, JavaScript or PHP-type files. It is off by default.

Step 1: Open Protection › Hardening

Open Protection › Hardening and find Admin-only SVG and code uploads.

Restrict SVG and code uploads: saved state and available controls in BetterShield. — Review the state and choices shown on your own site before applying a change.

Step 2: Restrict SVG and code uploads

Open its preview and read what will change. The preview changes nothing.
There are no extra fields. Accounts below administrator cannot upload SVG, HTML, JavaScript or PHP-type files.
Turn on the fix. If the screen asks you to confirm recovery or your password, complete that before continuing.

Recommended settings

Our advice is to test this on staging, then apply it when the behavior fits the site. Keep a working recovery method before changes affecting sign-in or the site address.

What it can break and how to undo

An editor uploading SVG artwork may be refused. This is separate from stopping PHP execution in uploads. Turn the fix off to use its undo, then check the original workflow. A change is recorded in the activity log; an undo does not erase that record.

Final Outcome

The finding Non-admin users can upload files that can run code does not count an administrator who also holds a lower role, or a super admin, because the fix leaves them alone. A role held only by them is skipped. The row should show the fix is on. Test the affected operation with an appropriate account, then check the finding. The score and Findings update on their own after the change. If the finding stays open, press Check Again to see what the check still sees. A server or another plugin can enforce a setting independently, so switching BetterShield off does not necessarily remove that other protection.

This is how you can restrict SVG and code uploads with BetterShield.

Getting Stuck? Feel free to contact our Dedicated Support Team.