404ops Upload Settings

Control which file types can be uploaded, and the maximum file size, from one settings screen. Set both for the whole site, and optionally override either for individual user roles. The plugin uses WordPress's own upload filters, so WordPress core files are never modified. Nothing is restricted until you configure it.

Features

• Allowed file extensions as a comma-separated list such as jpg,png,pdf. An extension covers its format, so jpg also allows jpeg and jpe.
• A maximum upload size in megabytes, limited to your server's PHP upload limits, which the settings page shows.
• Per-role rules that override the extensions, the size, or both. A blank field uses the site-wide setting.
• A user with several roles gets the largest size cap and the combined extension list of those roles.
• Real file-content checks. An allowed extension is not enough: the plugin reads the file's bytes and refuses a renamed script or a mismatched type. SVG uploads are sanitised of scripts before they are saved.
• Per-user rules and storage quotas, set one line per person.
• An upload activity log of every allowed or refused upload, with the reason for each refusal.
• Anomaly screening: five local signals flag suspicious uploads into a log for review.
• A network baseline on multisite, which is pushed to selected sites. Each site keeps control of its own settings.
• Optional AI-assisted rule authoring. You describe the policy and review the proposed rules before anything is saved. This needs an AI provider you connect yourself.

Free version

The free version is available on WordPress.org once it is listed there.