WordPress Development Stack Exchange is a question and answer site for WordPress developers and administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I'm trying to create a Theme Customizer control in Wordpress that will allow the user to upload an MP4 and WEBM video, and in doing so I need to create a sanitization option to verify the file type. I'm having some trouble and can still upload any type of file...

Here's what I'm doing:

function customizer_header_image( $wp_customize ) {

  // Header Background Video (MP4)
  $wp_customize->add_setting( 'header_video_mp4', array(
    'default'             => '',
    'sanitize_callback'   => 'check_header_video'
  ) );

    new WP_Customize_Upload_Control( $wp_customize, 'header_video_mp4_control', array(
      'label'             => __( 'Header Video (MP4)', 'rainier' ),
      'section'           => 'header_image',
      'settings'          => 'header_video_mp4',
    ) )


// Register the customize functions
add_action( 'customize_register', 'customizer_header_image' );

// Custom sanitize function for header video uploads
function check_header_video($file){
  return validate_file($file, array('webm', 'mp4'));

As you can see I pass the control's 'sanitize_callback' parameter to my check_header_video, and in there you can see in that function that it runs the file against a native Wordpress function validate_file, with accepted file types.

Not having much luck. Does anyone know what I'm doing wrong here?

share|improve this question
up vote 0 down vote accepted

validate_file doesn't quite work the way you're expecting it to - it checks if $file is in the allowed files array, not just its extension/mime type.

You're looking for wp_check_filetype. However, all that ultimately does is check the extension (i.e. it doesn't read the headers of the file/ascertain the mime type otherwise).

Unless you implement your own PHP library for mime checking, it'd be quicker & easier to perform a simple regex check on the filename:

return preg_match( '/\.(mpe?g4?|webm)$/', $file ); // Or similar
share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.