NR Safe SVG

SVG files are perfect for logos and icons: they are tiny and stay razor sharp on every screen. WordPress blocks them for a good reason. An SVG is really a small program, and a bad one can hide code that runs in your visitors’ browsers or takes over a logged-in administrator’s account. A logo from a supplier, a download from an icon website or a file from a designer’s old computer could all carry it without anyone knowing.

NR Safe SVG lets you use SVGs without that risk. Every SVG is checked before it is saved, against a list of the drawing parts that are known to be safe. Anything else is removed: scripts, hidden web pages, event code such as “onload”, javascript: links, animations that change links, pictures and files loaded from other websites, and unsafe styles. The file is read with internet access switched off, so the “XXE” and “billion laughs” tricks that catch out other SVG tools simply don’t work. Files that can’t be made safe are refused with a plain-English reason. Your logos look exactly the same afterwards: we tested Inkscape and Illustrator exports, icons, sprites, gradients, masks, filters and animations pixel by pixel.

You choose who may upload SVGs (only Administrators to start with). SVGs then work like any other picture: they show properly in the Media Library, the editor and on your pages, at the right size. For logos and icons there is an “Inline SVG” block and an [nr_svg] shortcode that put the SVG straight into the page, so it can take on your text colour, with a proper title for screen readers or a “decorative only” switch.

Already have SVGs on your site? One button checks every SVG in your Media Library, cleans the dangerous ones and shows you exactly what it found, with a backup of each original. You can also check any file before uploading it, with a before-and-after preview.

Made by Nomad Robin, with a plain-English “How to use” screen built in.

Key features

• Lets you upload SVG and (optionally) SVGZ files to WordPress safely
• Every SVG cleaned on upload with a strict allow-list of safe SVG parts
• Removes scripts, including hidden and upper-case variations
• Removes foreignObject, iframe, embed and object (hidden web pages)
• Removes every event attribute such as onload, onclick and onmouseover
• Removes javascript:, vbscript: and data: links, even when disguised
• Removes animate and set tricks that turn a link into javascript:
• Removes pictures and files loaded from other websites; keeps embedded PNG, JPEG, GIF and WebP pictures
• Removes use elements that point at other files
• Removes unsafe CSS: @import, external url(), expression(), behaviour and binding tricks, in style attributes and style blocks
• Removes processing instructions such as xml-stylesheet (XSLT)
• Safe XML reading: no internet access, no entity expansion, no DTD loading
• Blocks XXE (external entity) attacks, external DTDs and parameter entities
• Blocks "billion laughs" entity-expansion bombs
• Refuses UTF-7 and other trick text encodings
• Refuses files that are web pages in disguise
• Size limit for SVG files, which also stops "bomb" files
• Optional .svgz support: unpacked with a hard size limit (no zip bombs), cleaned and saved as plain .svg
• Cleaned again when a file is replaced by a "replace media" tool
• XML-RPC and importer uploads refused if they contain dangerous code
• Choose which user roles may upload SVGs (Administrators only by default)
• Width and height read from each SVG (px, pt, mm, cm, in or viewBox)
• SVGs show properly in the Media Library grid, pop-ups and featured image box
• Correct width and height in the editor and on your pages, with no pointless srcset
• Optional minify to make SVGs smaller with no visible change
• Inline SVG block for the block editor, with a live preview
• [nr_svg] shortcode with id, title, desc, decorative, width, color, align and link options
• Inline output cleaned again before it is shown, and cached until the file changes
• Accessible inline SVGs: title and description for screen readers, or "decorative only"
• Unique ids for every inline copy, so the same SVG can appear twice on a page
• Inline SVGs can take your text colour (currentColor icons)
• "Check existing SVGs" tool that checks your whole Media Library in safe batches
• Report-only mode that changes nothing
• Clear report for every file: safe, tidied, cleaned (with what was removed) or refused
• Originals kept in a protected backup folder, downloadable from the report
• Files that can't be made safe replaced with an empty placeholder, original kept
• "Check a file" test bench with before-and-after preview and cleaned code to copy
• "SVG safety" line on every SVG in the Media Library
• Activity log of uploads, replacements and checks, with a retention setting
• Nonce and permission checks on every action
• Nothing loads on your public pages and no database tables are added
• Keeps your data when uninstalled unless you choose otherwise
• Translation-ready
• Built-in "How to use" tab in plain English
• Version number shown on the plugin's screen
• Works on phones and tablets
• One price: use it on as many sites as you like

Screenshots

Details and requirements

Changelog

• 1.0.0 27 Oct 2026 — First release

Questions

Prices in pounds. I'm not VAT registered, so no VAT is added. Digital Products Terms