Ask the Origin – Remote Media Proxy

FAQ

Does this copy or synchronize my Media Library?

No. The plugin serves missing files from matching uploads paths on the configured source. It does not import attachment records, migrate content or synchronize uploads. Existing local files are never replaced.

If you need the source site’s pages, posts and Media Library entries, copy that content separately as part of your development setup.

Where are files cached?

Files are cached in WordPress’s temporary directory, which must be writable and outside the public web root. Use WP_TEMP_DIR to select a different directory if needed. Local files are used first, then cached files, then remote downloads.

Cached files are fresh for five minutes. Expiration does not delete them, and there is no automatic cache cleanup. There is no download-size limit; large files can fill temporary storage. The plugin is intended for images and modest-sized files, not large video delivery.

If the source is unavailable, local files and fresh cached files still work. Expired files are not served. Browser-cached media may remain visible briefly after disabling the proxy or changing its settings.

Does it work with Timber and Flynt?

The plugin integrates with Timber 1 and 2, including Twig’s resize filter, and Flynt‘s resizeDynamic calls.

When the local original and derivative are missing, supported resizes return signed image URLs. The image request retrieves the remote derivative or, only after a remote 404, downloads the original and resizes it with Timber. Existing local files retain native behavior.

The resizing integration requires allow_url_fopen and REST API access. Forced resizing, Retina generation from missing originals, SVG transformations, custom Resize subclasses, arbitrary transformation chains, and Flynt’s separate on-demand generation mode are not supported. Filters applied only during template rendering do not carry over to the image request.

Changing the source configuration or WordPress authentication keys invalidates signed URLs; refresh cached HTML afterwards.

Can PHP read missing attachments?

Compatible readers can use the read-only URI returned by get_attached_file(). This requires allow_url_fopen.

Obtain the URI each request rather than storing it. Code that requires a physical file in uploads may not work; general filesystem access and image editing are not covered.

How are credentials and protected media handled?

Use HTTPS and trust the configured source. Saved passwords are encrypted using WordPress authentication keys; changing those keys or the site ID requires re-entering saved passwords.

Administrators with access to Media settings can inspect the saved password. Code-supplied passwords are not stored or displayed.

The plugin follows WordPress’s allowed file types, but does not sanitize SVG content if SVG uploads are enabled.

Can I configure it in code?

Yes. Define any of these constants in wp-config.php to override saved settings:

• ASK_THE_ORIGIN_ENABLED: a boolean.
• ASK_THE_ORIGIN_URL: the source site’s base URL.
• ASK_THE_ORIGIN_USERNAME: the HTTP Basic Auth username.
• ASK_THE_ORIGIN_PASSWORD: the HTTP Basic Auth password.

Use strings for the URL and credentials. Defined false and empty strings are intentional overrides. Constant-controlled fields are disabled in Media settings; their saved values remain available if the constants are removed.

Configuration is applied in this order: saved settings, constants, then the ask_the_origin_options filter. The filter receives and must return an options array. Its keys are enabled, url, username and password; preserve any other values you are not changing.

`php

add_filter(‘ask_the_origin_options’, static function (array $options): array {
$options[‘enabled’] = true;
$options[‘url’] = ‘https://origin.example’;
return $options;
});
`

Load configuration on every request, including REST and media requests—not only during template rendering. Visit the site’s admin after configuration changes to update Apache routing.

A constant or filter that fixes the proxy status makes the toolbar status control read-only. Overriding other fields alone does not lock the toggle.

See the configuration examples and details.

What happens when I disable or remove it?

Disabling or deactivating removes the plugin’s Apache directives and retains settings. Uninstalling also removes settings, never uploads or attachment data.

Cached files are left for host or administrator cleanup. If Apache rule cleanup fails, correct the reported .htaccess problem and retry disabling, deactivating or uninstalling the plugin.

Disable the proxy before moving WordPress or its content directory.