- Article
- Intermediate
- 2 minutes read
- Reviewed August 4, 2026
File uploads cross a security boundary.
A user can submit an executable file, misleading extension, oversized archive, malicious document or content designed to exploit a later processor.
Authorize the Upload
Check whether the current user or anonymous workflow is allowed to upload the requested type of file.
A valid nonce does not grant upload capability.
Validate Type and Extension
Check both filename extension and detected file type where supported.
Maintain an allowlist of required formats. Do not accept every MIME type supplied by the browser.
Limit Size and Quantity
Apply limits appropriate to the workflow.
Large files and repeated requests can exhaust storage, memory and processing capacity.
Safe Filenames
Use WordPress filename sanitization and avoid trusting user-supplied paths.
Prevent directory traversal, hidden executable extensions and collisions.
Storage Location
Public uploads are normally accessible by URL.
Sensitive documents need protected storage and an authorized download controller. A random URL is not access control.
Prevent script execution in upload directories through server configuration where appropriate.
Image and Document Processing
Media libraries and document converters are additional attack surfaces.
Keep image and document-processing libraries updated. Run high-risk processing in isolated systems when necessary.
Malware Scanning
Scanning can provide another control but is not perfect.
Define what happens when a file is suspicious, unavailable for scanning or later reclassified.
Frequently Asked Questions
Is checking the file extension enough?
No. Validate the type, content where possible, permissions and storage behavior.
Are Media Library files private if they are unattached?
No. Unattached normally describes editorial association, not access protection.
Continue Learning
Previous: [Validation, Sanitization and Escaping](/resources/wordpress-manual/security/validation-sanitization-escaping/)
Next: [WordPress REST API Security](/resources/wordpress-manual/security/rest-api-security/)