Why WordPress Won’t Let You Upload That File (And How to Fix It Safely) – 2 solution
Why WordPress Won’t Let You Upload That File: You’re trying to upload a ZIP file, an APK, or maybe an EXE, and WordPress just stops you cold: “Sorry, you are not allowed to upload this file type.” No further explanation, no obvious button to click past it. If you’ve never run into this before, it feels like the upload button is just broken.
It’s not broken — WordPress is doing this on purpose. It maintains a list of file types it considers “safe” to upload by default, and anything outside that list gets blocked automatically, no matter your admin permissions. It’s a security decision built into WordPress core, not a bug.
The good news is that in most cases, there’s a legitimate and fairly simple way around it — you just need to understand what’s actually causing the block first, because the fix is a little different depending on the reason.
Quick Diagnostic: What’s Actually Blocking You
| What you’re seeing | Likely cause | Where to look first |
|---|---|---|
| Blocked immediately with WordPress’s own error message | File extension isn’t in WordPress’s allowed list | WordPress’s default upload restrictions |
| Upload seems to start, then fails partway or times out | Server-side file size or execution limits | Hosting/server configuration |
| Blocked with no clear WordPress message, or a generic 403 error | Hosting-level security rule (mod_security, firewall) | Your host’s security settings |
| ZIP file blocked specifically | Almost never WordPress core — something else layered on top | Security plugin, hosting rule, or multisite settings |
| EXE or APK blocked | Intentional — not in WordPress’s default list at all | Needs to be explicitly added if you have a legitimate reason |
| Blocked even after changing settings | A security plugin overriding your changes | Check plugins like Wordfence, Sucuri, iThemes |
Worth checking this table first, since “file type not allowed” and “upload failed” for other reasons often get lumped together by users, but they need different fixes.
How WordPress Actually Checks Uploaded Files
This part matters, so it’s worth being precise rather than hand-wavy about it.
WordPress doesn’t treat extension-checking and content-checking as two separate, equal tests running side by side. It’s more layered than that.
First, WordPress compares the file’s extension against its list of allowed types. If the extension isn’t on that list at all, the upload gets rejected immediately — this is the block most people run into, and it happens before any deeper inspection takes place. This extension check is the main gate, and it’s what you’re almost always fixing when you see the “not allowed” message.
If the extension is on the allowed list, WordPress then runs a secondary check (introduced in WordPress 4.7.1) that tries to verify the file’s actual content matches what the extension claims. How reliable this check is depends on the file type:
- For images, WordPress can genuinely inspect the file data itself, so a
.jpgthat’s secretly something else is fairly easy to catch. - For most other formats — documents, archives, and similar — this deeper verification depends on a PHP extension (
fileinfo) being available and properly configured on the server, which isn’t consistent across every hosting environment. Where it’s missing, WordPress falls back more heavily on the extension and a basic MIME type reported by the browser, which is a noticeably weaker check than people tend to assume.
So in practice: the extension allow-list decides whether your upload even gets a chance, and the content check behind it is a second layer whose strength varies depending on file type and server setup.
Where ZIP Actually Stands
This is a common point of confusion, so it’s worth being exact about it. ZIP is included in WordPress core’s default list of allowed file types. It’s not blocked out of the box, and it’s not a “sometimes yes, sometimes no” situation at the WordPress level. RAR, 7z, GZIP, and TAR are handled the same way.
So if you’re getting a “not allowed” error on a ZIP file specifically, WordPress core generally isn’t where that block is coming from. It’s far more likely to be one of these instead:
- A hosting-level security rule (like mod_security) intercepting the upload before WordPress even sees it
- A security plugin (Wordfence, Sucuri, and similar) applying its own separate restriction on top of WordPress’s defaults
- A multisite configuration, where individual site admins can be given a narrower allowed-file list than what WordPress ships with by default
- A file size limit, which produces a failure that can look similar to a type-restriction error at first glance
EXE and APK are genuinely different. Neither is in WordPress’s default allowed list — full stop — for the malware-distribution reasons covered below. That distinction matters in practice: fixing a blocked ZIP usually means restoring WordPress’s normal default behavior, while enabling EXE or APK means deliberately opening something WordPress intentionally leaves closed.
Why WordPress Blocks Certain File Types by Default
WordPress’s default allowed list is fairly generous — images, documents, audio, video, PDFs, and common archive formats. What it excludes by default includes:
- EXE files — Windows executable programs. Blocked because an EXE uploaded to a website could, in the wrong hands, be used to distribute malware to visitors.
- APK files — Android app packages. Blocked for similar reasons; an APK is essentially an installable program, and hosting one carelessly is a known malware distribution method.
- PHP, JS, and other script files — Blocked because uploading a script and then accessing it directly on your server could let someone execute code they shouldn’t be able to run.
This isn’t WordPress being overly cautious for no reason. File upload restrictions are one of the more common ways websites actually get compromised, so the default list leans conservative on purpose.
âž› For More Visit Alice Academy
Solution 1: Allow the File Type Safely (For Legitimate Use Cases)
If you genuinely need to upload a specific file type — say, APKs for an app-related site — WordPress lets you expand the allowed list through a supported filter built for exactly this purpose. This isn’t working around a restriction; it’s using the mechanism WordPress provides.
The simplest way to do this is with a small plugin rather than editing code directly. WP Add Mime Types lets you tick a checkbox next to the file types you want to allow, no code required.
If you’re comfortable editing your theme’s functions.php file (back up first, or better, use a child theme), a small snippet does the same thing:
php Code:
function custom_upload_mimes($mimes) {
$mimes['apk'] = 'application/vnd.android.package-archive';
return $mimes;
}
add_filter('upload_mimes', 'custom_upload_mimes');Adjust the extension and MIME type for whatever format you actually need.
One caution worth repeating: only add file types you genuinely need, and only once you understand why they were restricted in the first place. Adding EXE or APK support because you’re distributing your own tested software is a legitimate use case — but it also means you’re now responsible for making sure those specific files are safe, since WordPress’s built-in protection there is intentionally gone once you add the exception.
Solution 2: Check If Your Hosting Is the Real Block
Sometimes the fix above doesn’t work, because the restriction isn’t coming from WordPress at all — it’s coming from the hosting server. Many hosts run additional security layers (mod_security rules, for instance) that block certain uploads before WordPress even gets a chance to process them.
You’ll usually notice this because the error doesn’t look like WordPress’s usual message, or you get a generic 403 Forbidden error instead. If that’s what you’re seeing, changing WordPress’s MIME settings won’t help, since the block is happening a step earlier in the process.
Your best move here is contacting your hosting provider directly and asking whether they restrict uploads of the specific file type you need. Some hosts will adjust this on request, especially on business or managed plans; others — particularly very cheap shared hosting — may not allow it at all, applied across their entire server for security reasons.
Solution 3: Check for a Security Plugin Overriding Your Settings
If you’ve added the file type through a plugin or code and it’s still blocked, a security plugin is a likely reason. Wordfence, Sucuri, and iThemes Security often ship with their own upload restrictions layered on top of WordPress’s defaults, and these can override the change you just made.
Check that plugin’s settings for anything related to “file uploads,” “file type restrictions,” or “firewall rules.” You may need to add a separate exception there too, on top of the WordPress-level change.
A Word on Security Before You Loosen Any Restriction
Worth pausing on this, because it’s the genuinely important part, not just a formality.
Enabling uploads for something like EXE or APK files isn’t inherently dangerous if you control who’s uploading and you know exactly what’s being uploaded — distributing your own tested software, for example. But if your site accepts uploads from other users — a membership site, a forum, an open submission form — opening up executable file types is a real risk. It hands anyone who can upload files a potential way to distribute malware through your site.
If you only need to distribute a specific EXE or APK (not accept them from users), a safer alternative is often to host the file elsewhere — Google Drive, a dedicated file-hosting service, or your host’s file manager directly — and simply link to it from WordPress, rather than uploading through the Media Library at all. This sidesteps the restriction entirely without loosening any security setting.
If Nothing Above Works
Occasionally the issue isn’t the file type at all, but something else getting mistaken for it:
- Check your file size limit. A file that’s a genuinely allowed type can still fail to upload if it exceeds your server’s max upload size, and the resulting error isn’t always clear about which problem you’re actually hitting.
- Try a different browser or clear your cache, in case an outdated admin interface is producing a false error.
- Confirm your account has sufficient permissions. On multi-author sites, contributor or author roles sometimes have tighter upload restrictions than admins, depending on what other plugins are installed.
Wrapping Up
The “you are not allowed to upload this file type” message looks like a glitch, but it’s really WordPress doing its job — filtering out file types that are common vectors for malware, and requiring you to explicitly confirm you know what you’re doing before allowing them through. For most legitimate cases, a plugin like WP Add Mime Types or a small code snippet solves it in a couple of minutes.
Just take a moment to think about who else can upload files to your site before loosening these restrictions — that’s really the only part of this that carries genuine risk.
