[desrosj]

Adds a multisite Site Health check that recommends the file types a network created today would allow uploading, when the network's list is missing any of them.

The upload_filetypes network option is populated once, in populate_network_meta(), and upgrades never change it:

• r50810 (5.8) added webp to the defaults, and [57524] (6.5) added avif.
• r58400 (6.6, #53167) switched new networks to every extension from get_allowed_mime_types(), and notes that existing networks are not affected.

So networks created before 5.8 cannot upload WebP, those created before 6.5 cannot upload AVIF, and those created before 6.6 are missing most of the types a single site allows. Any type core adds later (JPEG XL, for example) will also be missing from every existing network. With client-side media processing, a missing image type can also stop generated sub-sizes from being sideloaded (see PR 15859).

The check

• Registered on every site of a network, when is_multisite(). On multisite, only super admins can see Site Health (wp_maybe_grant_site_health_caps()), as with the other checks that look at the network.
• Good when the network allows every default type. Recommended otherwise, listing the missing extensions and saying that adding them is optional.
• Only missing defaults are reported. Types the network allows beyond them (SVG, say) are ignored.
• Matched the way check_upload_mimes() matches. An extension isn't reported when another extension of the same type already allows it, so jpe isn't reported when jpg is allowed.
• HTML and JavaScript are never recommended. The defaults are built as get_allowed_mime_types() builds them for a user without unfiltered_html. This also means the result doesn't depend on who is viewing it, or whether it runs from cron.
• The "Update the allowed upload file types" link to Network Settings is only shown to users with manage_network_options.

Open question: the length of the list

On a network still on the oldest defaults, the check currently lists about 130 extensions. For networks created between 5.8 and 6.5, it still lists dozens of non-image types (bmp, tiff, ico, heic, txt, csv, zip, the Office and OpenDocument formats, and so on). It may be better to limit the recommendation to image formats, or to group the list by type.

Testing

tests/phpunit/tests/admin/wpSiteHealthGetTestNetworkUploadFiletypes.php:

npm run test:php -- -c tests/phpunit/multisite.xml --filter Tests_Admin_wpSiteHealthGetTestNetworkUploadFiletypes
npm run test:php -- --filter Tests_Admin_wpSiteHealthGetTestNetworkUploadFiletypes

The site-health group passes on single site (122 tests) and multisite (130 tests).

Manually: on a multisite install, set Network Admin → Settings → Upload file types to jpg jpeg png gif, then open Tools → Site Health on any site as a super admin.

Trac ticket: TBD

Use of AI Tools

AI assistance: Yes
Tool(s): Claude Code
Model(s): Claude Opus 5.5
Used for: Researching how the network defaults changed, and drafting the check, tests and this description. To be reviewed by me.

🤖 Generated with Claude Code

---

This Pull Request is for code review only. Please keep all other discussion in the Trac ticket. Do not merge this Pull Request. See GitHub Pull Requests for Code Review in the Core Handbook for more details.

[github-actions]

Test using WordPress Playground

The changes in this pull request can previewed and tested using a WordPress Playground instance.

WordPress Playground is an experimental project that creates a full WordPress instance entirely within the browser.

Some things to be aware of

• All changes will be lost when closing a tab with a Playground instance.
• All changes will be lost when refreshing the page.
• A fresh instance is created each time the link below is clicked.
• Every time this pull request is updated, a new ZIP file containing all changes is created. If changes are not reflected in the Playground instance,
  it's possible that the most recent build failed, or has not completed. Check the list of workflow runs to be sure.

For more details about these limitations and more, check out the Limitations page in the WordPress Playground documentation.

Test this pull request with WordPress Playground.