ScanUpload

Description

ScanUpload adds a QR-code upload widget to any page with a shortcode. A visitor scans the QR code with their phone, uploads files, and those files are automatically imported into your WordPress site.

How it works

1. You add the [scanupload] shortcode to any page or post.
2. The page renders a live QR code.
3. A visitor scans it with their phone and uploads files using the ScanUpload mobile flow.
4. Files arrive in your WordPress site automatically (Media Library or a sub-folder, your choice).

The plugin is powered by the ScanUpload service, which requires a free ScanUpload account, Client ID and Client Secret.

Features

• Configurable Client ID and Client Secret, stored securely in the WordPress options table.
• Choose where uploads land: Media Library (unattached), Media Library attached to a post/page, or a dedicated uploads sub-folder.
• Live file preview while the visitor uploads.
• Fully automatic import – no button clicks required.
• Works on any theme via the [scanupload] shortcode.

Getting started

1. Create a free account at app.scanupload.net and copy your Client ID and Client Secret from Dashboard → Settings → Client Credentials.
2. In WordPress, open Settings → ScanUpload, paste both values and click Save Settings.
3. In the ScanUpload Dashboard, add your site address to Allowed Origins (for example https://example.com). While developing on localhost, enable Test Mode instead.
4. Add the [scanupload] shortcode to the page where you want the widget (see below).

That is the whole configuration. Until credentials are saved, the widget shows a friendly “ScanUpload is not configured” message instead of a QR code.

Putting the widget on a page

Block Editor (nothing extra to install): edit the page, click +, search for Shortcode, add the block and paste [scanupload] into it.

Elementor: drag the Shortcode widget into the page and paste [scanupload] into its Shortcode field.

Any other theme or builder that renders shortcodes: paste [scanupload] where the widget should appear.

A visitor then points their phone camera at the code, chooses the files they want to send, and the files arrive on your site automatically. The widget lists each file as it arrives, so the visitor can see the upload working.

Where do the files go?

• Media Library, unattached (import_mode="media", the default) – files appear under Media → Library.
• Media Library, attached to a post or page (import_mode="media_attach") – files appear in the library, attached to the post or page you choose.
• A sub-folder of the uploads directory (import_mode="folder") – files are saved under wp-content/uploads/<sub-folder>/ and are not added to the Media Library.

In folder mode the plugin also writes .htaccess, index.html and web.config guard files into that folder so uploaded files cannot be executed.

Shortcode

[scanupload]

Optional attributes:

• header – Header text shown above the QR code. Default: “Upload files from your phone”.
• show_header – 1 or 0. Default 1.
• size – small, medium, large or xlarge. Default large.
• file_preview_mode – list or grid. Default list.
• import_mode – media, media_attach or folder. Overrides the site-wide setting for this widget.
• attach_to – Post ID to attach imported media to when import_mode="media_attach". Use attach_to="current" to attach to the post currently being viewed.
• class – Extra CSS class for the widget container.

Example:

[scanupload header="Scan to send us files" size="large" import_mode="media_attach" attach_to="42"]

When a logged-in visitor uploads files, the imported attachments are attributed
to that user. Anonymous visitors upload unattributed (author 0).

Media is only attached to a post the uploader is allowed to edit; otherwise it
is imported unattached. Use the scanupload_allow_attach_to_post filter to
allow guest submissions to a fixed public post.

Developer Hooks

• scanupload_import_author_id – author ID assigned to imported attachments (default: the current user, 0 for anonymous visitors).
• scanupload_allow_attach_to_post – whether imported media may be attached to a post (default: only when the uploader can edit it). Use it to allow guest submissions to a fixed public post.
• scanupload_import_rate_limit – maximum import requests per rate-limit window (default 10).
• scanupload_import_rate_window – rate-limit window in seconds (default 600, i.e. 10 minutes).
• scanupload_import_client_ip – client IP used for rate limiting (default: the direct peer address). Useful behind a trusted reverse proxy.

External services and data

This plugin is a bridge to the ScanUpload service and only connects to it when you configure it and a visitor uses the widget:

• The visitor’s browser creates a scan upload session with ScanUpload (https://hub.scanupload.net) when a [scanupload] widget is shown. The browser sends only the configured Client ID and your site’s origin.
• Your server requests an access token from the ScanUpload identity service (https://identity.scanupload.net) using the Client ID and Client Secret you entered.
• Your server downloads the uploaded files for a session and imports them into your own WordPress site.

No tracking or analytics data is collected or sent by this plugin. Uploaded files are transmitted to and from the ScanUpload service solely to operate the upload feature, and are then stored on your site. No data is shared with any third party. See the ScanUpload Terms and Conditions for how ScanUpload handles the files it processes.

By installing, configuring and using the plugin you consent to the connections described above.

Credits

This plugin bundles the following open-source libraries. Both are included as
readable, unminified source so the shipped code can be reviewed as-is:

• @microsoft/signalr – MIT License. Used for the live file preview.
• qrcode-generator – MIT License. Used to render the QR code.

Both licences are GPL-compatible. The plugin’s own code is licensed under
GPL-2.0-or-later; see license.txt.