Why does WordPress say this file type is not permitted for security reasons?

WordPress only accepts file types on its allowed list, and it also checks that a file's contents match its extension. SVG, fonts and JSON files are not on the default list, and a renamed or mislabelled image is refused by the contents check.

How do I upload an SVG logo to WordPress safely?

Use a PNG of the logo at twice its displayed size, or install one plugin that sanitises SVG uploads. Do not add a snippet that simply allows SVG, because an SVG file can carry script.

Should I use ALLOW_UNFILTERED_UPLOADS to fix the file type error?

No. It turns off the file type check for administrators completely and tends to stay on. Save the file in an accepted format, use the import screen the file is meant for, or allow only the one type you need.

More fixes

"Sorry, this file type is not permitted for security reasons"

You upload a file to WordPress (a price list as CSV, a font, a logo as SVG, a JSON export from another tool) and it is refused with "Sorry, this file type is not permitted for security reasons." Newer WordPress words the same refusal as "Sorry, you are not allowed to upload this file type." It is not a broken site and not a size problem: WordPress keeps a list of the file types it accepts, and it also checks that a file's contents match its name. Below is a rebuilt example (not a real client), then which case you are in and the safe fix for each.

What the owner sees in Media, Add New

harborlinetackle.example/wp-admin/media-new.php

What the checks found

Find out which case it is (two minutes)

Look at the file's real extension. Windows hides extensions by default: in File Explorer, View, tick "File name extensions". logo.svg, font.woff2, data.json and photo.heic are the usual ones.
Is it a type WordPress refuses for everyone? Out of the box WordPress accepts common images (JPEG, PNG, GIF, WebP, and AVIF in recent versions), PDFs, Office documents, CSV and plain text, audio and video. It refuses SVG, fonts (WOFF, WOFF2, TTF, OTF), JSON, and anything that can run on the server, such as PHP or EXE.
If the type should be accepted, the contents do not match the name. Since WordPress 5.0.1 the server looks inside the file. A JPEG renamed to .png, or a CSV that the server reads as some other kind of text, is refused even though its extension is on the list.
On a multisite network, there is a second list: Network Admin, Settings, "Upload file types". A type missing there is refused on every site in the network.

The fixes, by case

An image in the wrong format (HEIC, a renamed file). Open it and save or export it again as JPEG or PNG, so the contents match the name. iPhones can save JPEG directly: Settings, Camera, Formats, Most Compatible.
SVG logos and icons. WordPress blocks SVG because an SVG file can carry script. Use a PNG of the logo at twice the size it is shown, or install one plugin that sanitises SVG uploads (it strips the code and keeps the drawing). Do not add a snippet that only adds svg to the allowed list: that lets any uploader place script on the site.
Fonts (WOFF2, WOFF, TTF). Fonts usually belong in the theme, not the Media Library: recent block themes have a font manager (Appearance, Editor, Styles, Typography), and page builders have their own custom-font upload. If you really need a font in Media, allow that one type only, with a short upload_mimes filter in a small must-use plugin (adding woff2 as font/woff2).
CSV that is refused. CSV is on the list, so this is the contents check. Update WordPress first (later versions accept the common ways servers read a CSV). If it still fails, save the file again from your spreadsheet as "CSV UTF-8", and if you are importing products or users, use the importer's own upload screen (for WooCommerce: Products, Import) rather than the Media Library.
JSON and other data files. Most of these are meant for an import screen, not for Media: a settings or form export goes in that plugin's own import page, and a theme or plugin goes in Plugins or Themes, Add New, Upload.
Multisite. As the network admin, add the extension (without the dot) to "Upload file types" in Network Admin, Settings, and check the "Max upload file size" next to it.
Test: upload the file again, open it from the Media Library or the page it is used on, and check the page on a phone.

What you see, what it means, what it needs

What you see	What it means	Usual fix
SVG refused	Blocked on purpose: an SVG can carry script	PNG instead, or one SVG-sanitising plugin
WOFF2 / TTF font refused	Fonts are not on the default list	Theme's font manager or the builder's font upload; at most allow that one type
JPEG or PNG refused	Contents do not match the name (renamed, or really HEIC)	Save it again as a real JPEG or PNG
CSV refused	The server reads its contents as another type	Update WordPress, re-save as CSV UTF-8, use the importer's upload
JSON refused in Media	Data files are not media	Use the plugin's or theme's own import or upload screen
Every site in a network refuses a type	Missing from the network's "Upload file types"	Network admin adds the extension
"exceeds the maximum upload size"	A size limit, not a type problem	See the upload guide

What not to do

Do not add define('ALLOW_UNFILTERED_UPLOADS', true); to wp-config.php. Tutorials suggest it, but it switches off the type check for administrators entirely, and it stays on long after the one upload you needed.
Do not install a plugin that "allows all file types". The types WordPress blocks are the ones that can run code or carry script.
Do not rename a file's extension to get it past the check. The contents check refuses it anyway, and if it did not, the file would open wrongly for visitors.
Do not copy files by FTP into wp-content/uploads to dodge the refusal. They will not show in the Media Library, and an unchecked file sits in a public folder.

Most of these are a logo saved as SVG or a photo in the wrong format, and are gone once the file is saved again as PNG or JPEG. If a type you need is refused and you are not sure which fix is safe for your site, that is what the box below is for. Related: a photo will not upload and "the link you followed has expired".