WordPress 7.1 plans to expand the Icon API with public registration, unregistration, collections, theme support, SVG sanitization, and namespace validation. Plugins that register custom icons should prove unsafe markup is rejected while valid branded icon sets remain usable.
Use this for block plugins, themes, agency icon libraries, design systems, icon picker integrations, and any code that accepts SVG supplied by administrators or remote packages.
Quick answer
WordPress 7.1 Icon API SVG Sanitization Regression Test should be handled with a narrow evidence-first workflow: register valid collection, run hostile fixtures, test rest roles, then verify the result before making broader changes.
What to check first
- Register a small valid collection with unique namespaces, predictable names, viewBox values, and accessible labels.
- Test fixtures containing script, event handlers, external references, foreignObject, malformed namespaces, and duplicate names.
- Verify REST permissions and responses for anonymous visitors, authors, editors, administrators, and multisite roles.
- Render icons in the editor and front end while checking dimensions, fill behavior, caching, and duplicate IDs.
- Unregister the test collection and confirm picker, REST, cache, and saved-content behavior are understood.
Diagnostic table
Use this table to keep the work practical. It connects the symptom to evidence and a verification step.
| Action | Evidence to collect | How to verify |
|---|
| Register valid collection | Register a small valid collection with unique namespaces, predictable names, viewBox values, and accessible labels. | Unsafe SVG constructs are rejected or stripped before storage and rendering. |
| Run hostile fixtures | Test fixtures containing script, event handlers, external references, foreignObject, malformed namespaces, and duplicate names. | Valid icons retain the expected geometry, label, and theme behavior. |
| Test REST roles | Verify REST permissions and responses for anonymous visitors, authors, editors, administrators, and multisite roles. | Namespaces prevent collisions across two test plugins. |
| Compare rendered output | Render icons in the editor and front end while checking dimensions, fill behavior, caching, and duplicate IDs. | Removing a provider has a documented fallback for existing content. |
Why this usually happens
- SVG is markup and can contain executable or externally loaded content.
- Two plugins can choose the same collection or icon namespace.
- A REST endpoint can expose registration data more broadly than the editor UI.
- Saved blocks may reference an icon after its provider has been disabled.
Useful command or data shape
Adapt paths, IDs, and privacy handling to the site before running commands or storing data on production.
fixtures:
valid: simple-path.svg
reject:
- script-element.svg
- onload-handler.svg
- external-use.svg
- foreign-object.svg
- duplicate-namespace.svg
verify: [rest_status, editor_preview, front_end_dom]
Safe fix order
Do the work in a sequence that makes each result easy to prove. Stop if a step produces new evidence that changes the incident scope.
- Register valid collection
- Run hostile fixtures
- Test REST roles
- Compare rendered output
- Test unregister behavior
What to tell the client or owner
Share WordPress build, plugin, namespace, fixture name, registration result, REST role and status, sanitized output, rendered DOM, and fallback behavior.
Production verification checklist
- Unsafe SVG constructs are rejected or stripped before storage and rendering.
- Valid icons retain the expected geometry, label, and theme behavior.
- Namespaces prevent collisions across two test plugins.
- Removing a provider has a documented fallback for existing content.
Mistakes to avoid
- Do not judge the fix by one browser or the homepage only.
- Do not delete evidence before recording usernames, file paths, timestamps, and response headers.
- Do not add a cache, security, or tracking plugin while the original problem is still unclear.
- Do not leave test users, temporary debug logs, or broad API keys active after verification.
When HandL WP should help
Bring in help when this affects leads, checkout, search visibility, malware risk, paid media reporting, or a client production site. HandL WP can trace the issue through WordPress, hosting, cache, tracking, and Search Console, then verify the workflow after the technical fix.
If this is active on a production site, review a WordPress SVG or plugin change.
Related HandL WP guides
Use these related guides when the same issue touches tracking, security, checkout, or crawler visibility.
Fix icons that turn black or lose stroke after sanitization
When the source SVG passes registration but the rendered result changes, use the WordPress 7.1 Icon API stroke and fill fix to compare sanitized markup, supported shapes, computed CSS, color modes, accessibility labels, and block, REST, and PHP output.
Helpful references