Dprime Safe SVG v1.2.0

Enables SVG and SVGZ uploads to the WordPress Media Library and sanitizes every file on upload using the enshrined/svg-sanitize library.

Installation Settings How it works Safe SVG block Developer filters Troubleshooting FAQ Override classes

Installation

Download the plugin zip from my.dprime.au.
Go to Plugins > Add New > Upload Plugin, choose the zip, and activate.
SVG uploads are enabled immediately after activation. Go to Dprime > Safe SVG to configure which roles can upload SVG files.

Note: The plugin ships with its vendor dependencies (enshrined/svg-sanitize) inside the zip. No Composer or npm step is needed after installation.

Settings

Setting	What it does
Roles	Tick which user roles can upload SVG files. Leave all unticked to allow any role with upload_files. Tick one or more roles to restrict SVG uploads to only those roles.
Allow large SVG files	Turns off the default 10MB safety limit in the sanitizer. Leave off for most sites. Turn on only if you work with large vector files regularly.

How it works

SVG and SVGZ are added to the WordPress allowed upload MIME types.
Every SVG file is scanned on upload against an allowlist of safe tags and attributes. Anything outside the allowlist is stripped before the file is written to disk.
SVGZ files are unzipped in memory, sanitized, then re-zipped. The saved file on disk is the clean version.
SVG metadata (width, height, viewBox) is read and stored so the Media Library shows correct dimensions.
SVG attachments are excluded from srcset generation. The single original file is served at all sizes.

Safe SVG block

The plugin registers a block in the Design category of the WordPress block editor. Select any SVG from the Media Library and the block inlines its markup directly into the page HTML.

Use the Safe SVG block when you need to style the SVG with CSS (targeting paths, fills, strokes), animate it with CSS or JS, or change its colours dynamically. For a static SVG that does not need styling, the standard Image block is simpler. The block adds a wrapper class you can target with dpss_inline_class.

Developer filters

Filter	Purpose
`dpss_svg_allowed_tags`	Override the list of allowed SVG tags
`dpss_svg_allowed_attributes`	Override the list of allowed SVG attributes
`dpss_current_user_can_upload`	Short-circuit the upload permission check
`dpss_upload_roles`	Filter the role list shown on the settings page
`dpss_pre_dimensions`	Return a custom width and height array to skip the built-in detector
`dpss_use_width_height_attributes`	Prefer width/height attributes over viewBox when calculating dimensions
`dpss_svg_dimensions`	Filter the final dimensions array
`dpss_inline_class`	Override the wrapper class on the inlined Safe SVG block
`dpss_inline_markup`	Override the full markup of the inlined Safe SVG block
`dpss_optimizer_enabled`	Turn the SVGO optimiser on or off
`dpss_svgo_params`	Filter the parameters passed to SVGO

Note: If you register a filter on dpss_svg_allowed_tags or dpss_svg_allowed_attributes, the SVGO optimiser is disabled automatically. The optimiser cannot honour custom allowlists, so leaving it on would produce files that fail later sanitization.

Troubleshooting

An SVG was rejected on upload

The sanitizer found content it could not safely strip. Open the file in a text editor and remove any script tags, foreignObject elements, or external references (href pointing outside the file), then upload again.

The SVG renders tiny in the Media Library

The file has no width, height, or viewBox attribute on the root svg element. Add one, re-save the file, and upload again. Most SVG editors can add a viewBox in the File or Document settings.

SVG colours are stuck even with custom CSS

The standard Image block serves the SVG as an external file. CSS on the page cannot reach inside it. Use the Safe SVG block instead, which inlines the markup so you can target paths and shapes directly.

Large SVG fails even with Allow large SVG files on

The upload size limit is set by your host, not this plugin. Check php.ini for upload_max_filesize and post_max_size, or ask your host to raise them.

FAQ

I was using the original Safe SVG plugin. Will my settings carry over?

Yes. Option keys (safe_svg_upload_roles, safe_svg_large_svg) and the safe_svg_upload_svg capability are the same as the original plugin. Upgrading does not lose any settings. Existing Safe SVG blocks in posts keep rendering.

What does the sanitizer actually remove?

The enshrined/svg-sanitize library strips any tag or attribute that is not on its allowlist. This includes script, foreignObject, on* event attributes, and external href references. The allowlist covers all standard SVG presentation and structure tags.

Does this work with Dprime Media Replace?

Yes. You can replace an SVG with another SVG using Media Replace once Safe SVG is active. The replacement goes through the same sanitization pass on upload.

Override classes

.dp-ss-page            { /* outer page wrapper */ }
.dp-ss-roles-table     { /* role checkbox table */ }
.dp-ss-roles-table th  { /* table headers */ }
.dp-ss-roles-table td  { /* table cells */ }
.dp-ss-toggle          { /* role checkbox row */ }
.dp-ss-large-toggle    { /* large SVG files toggle */ }
.dp-ss-list            { /* bulleted list in help tab */ }