MediaRef Cleanup Auditor

MediaRef Cleanup Auditor analyses attachment records, content, metadata, and the uploads filesystem using durable,
bounded jobs. It includes exact duplicate hashing, thumbnail analysis, optional live verification,
quarantine and restoration, builder and plugin capability reporting, REST workers, and WP-CLI.

There is no paid edition, scan limit, license server, advertising gate or required external service.
All processing occurs on the WordPress installation. Donations may support development but do not
change functionality.

Safety language is deliberate: “No reference detected” is not proof that an item is unused.
Dynamic code, remote consumers and unsupported data stores can create blind spots. Every cleanup
attempt performs a fresh targeted reference check and verifies file identity.

Built for large and old media libraries

Scans use database-backed jobs, keyset cursors, adaptive bounded batches, staged publishing, and
expiring worker locks. A browser refresh does not erase progress, and the same job can be resumed
with WP-CLI. The Storage Explorer groups files by year, month, MIME type, attachment ownership, and
derivative type, making sites with upload folders spanning many years easier to review.

Included without feature locks

• Media Library, metadata, options, builder, and filesystem reference analysis.
• Durable uploads manifest with missing, unknown, generated, and orphan-file classification.
• Exact duplicate groups using file size, MIME type, and SHA-256 fingerprints.
• Thumbnail inventory, missing-size analysis, selective cleanup review, and reporting.
• Optional same-origin live-page verification, disabled by default.
• Storage Explorer and Large Image Analyzer with date, folder, dimension, and size filters.
• Protected and ignored media states.
• Identity-checked private quarantine, restoration, and separate permanent deletion.
• REST dashboard workers and the complete wp mediaref-cleanup-auditor WP-CLI command set.
• Individual scanner classes for supported builders, galleries, commerce, LMS, membership,
  multilingual, cache, and custom-field ecosystems.

There is no Pro edition, image limit, scan limit, remote license validation, or required account.

WP-CLI

Common commands:

wp mediaref-cleanup-auditor status
wp mediaref-cleanup-auditor capabilities --format=json
wp mediaref-cleanup-auditor scan library --batch-size=250
wp mediaref-cleanup-auditor scan filesystem
wp mediaref-cleanup-auditor scan duplicates
wp mediaref-cleanup-auditor scan thumbnails
wp mediaref-cleanup-auditor scan live
wp mediaref-cleanup-auditor scan all
wp mediaref-cleanup-auditor scan resume --job=123 --batch-size=500
wp mediaref-cleanup-auditor results --status=potentially_unused --format=csv
wp mediaref-cleanup-auditor references 1250
wp mediaref-cleanup-auditor explain 1250
wp mediaref-cleanup-auditor protect 1250
wp mediaref-cleanup-auditor unprotect 1250
wp mediaref-cleanup-auditor ignore 1250
wp mediaref-cleanup-auditor unignore 1250
wp mediaref-cleanup-auditor trash 1250 --dry-run
wp mediaref-cleanup-auditor restore 10
wp mediaref-cleanup-auditor delete 10 --yes
wp mediaref-cleanup-auditor empty-trash --older-than=30 --yes
wp mediaref-cleanup-auditor export --status=potentially_unused --format=csv
wp mediaref-cleanup-auditor verify 1250
wp mediaref-cleanup-auditor repair
wp mediaref-cleanup-auditor cleanup-jobs

Machine-readable result commands support table, JSON, CSV and count formats through WP-CLI.

Security

Live verification is off by default. It accepts only the current site host, resolves and rejects
private/reserved IPs, validates every redirect, sends no cookies, limits redirects, response bytes
and time, and parses returned text without executing scripts or submitting forms.

Quarantine paths are exact, contained within uploads, and never selected through wildcard matching.
Remote objects are never deleted by the bundled local storage adapter.

Privacy

MediaRef Cleanup Auditor stores scan jobs, cursors, normalized media references, file-manifest data, results,
operation logs, and quarantine records in this WordPress database. This operational data is used
only to perform and audit media analysis and cleanup.

The plugin does not send telemetry or site data to the author. Optional live verification makes
unauthenticated requests only to approved URLs belonging to the current site. It does not execute
scripts, submit forms, or send administrator cookies.

Support

For support, use the MediaRef Cleanup Auditor support forum on WordPress.org after the plugin is approved.
Before reporting a problem, include the WordPress and PHP versions, scan type, job ID, current
stage, and the sanitized error shown in MediaRef Cleanup Auditor. Never post private server paths or credentials.