Skips re-uploading images that already exist in your Media Library (matched by exact filename), avoiding duplicates when migrating content.<\/p>","1.0.0":"
Initial release of External Image Importer.<\/p>"},"ratings":[],"assets_icons":{"icon-128x128.png":{"filename":"icon-128x128.png","revision":3603890,"resolution":"128x128","location":"assets","locale":"","width":128,"height":128},"icon-256x256.png":{"filename":"icon-256x256.png","revision":3603890,"resolution":"256x256","location":"assets","locale":"","width":256,"height":256}},"assets_banners":{"banner-1544x500.png":{"filename":"banner-1544x500.png","revision":3603890,"resolution":"1544x500","location":"assets","locale":"","width":1544,"height":500},"banner-772x250.png":{"filename":"banner-772x250.png","revision":3603890,"resolution":"772x250","location":"assets","locale":"","width":772,"height":250}},"assets_blueprints":{},"all_blocks":[],"tagged_versions":["1.0.1"],"block_files":[],"assets_screenshots":[],"screenshots":[]},"plugin_section":[],"plugin_tags":[15235,11822,233,4155,25065],"plugin_category":[59],"plugin_contributors":[86264],"plugin_business_model":[],"class_list":["post-336996","plugin","type-plugin","status-publish","hentry","plugin_tags-external-images","plugin_tags-import-images","plugin_tags-media-library","plugin_tags-migration","plugin_tags-remote-images","plugin_category-utilities-and-tools","plugin_contributors-nerdcow","plugin_committers-nerdcow"],"banners":{"banner":"https:\/\/ps.w.org\/nerdcow-external-image-importer\/assets\/banner-772x250.png?rev=3603890","banner_2x":"https:\/\/ps.w.org\/nerdcow-external-image-importer\/assets\/banner-1544x500.png?rev=3603890","banner_rtl":false,"banner_2x_rtl":false},"icons":{"svg":false,"icon":"https:\/\/ps.w.org\/nerdcow-external-image-importer\/assets\/icon-128x128.png?rev=3603890","icon_2x":"https:\/\/ps.w.org\/nerdcow-external-image-importer\/assets\/icon-256x256.png?rev=3603890","generated":false},"screenshots":[],"raw_content":"\n
External Image Importer<\/strong> automatically uploads externally-hosted images to your Media Library when you paste external content into the WordPress editor, then rewrites every URL to point at your own local copy. It is built SSRF-safe<\/strong>: every remote fetch is validated and hardened before the file is downloaded.<\/p>\n\n Remove the hassle of importing external images by hand when you:<\/p>\n\n When you copy or migrate WordPress content between environments - for example from a dev or staging<\/strong> site to your live<\/strong> site - images embedded in that content stay hotlinked<\/em> to the source domain. The block HTML (or pasted classic-editor markup) keeps pointing at This plugin fixes that automatically: it finds the external image URLs, pulls the files into your own Media Library, and updates the content so everything is served from your own domain.<\/p>\n\n Server-side remote fetching is handled with defence in depth:<\/p>\n\n Paste your content as you normally would, then Publish or Save. When you do, the plugin scans the content for externally-hosted images, securely downloads each one into your Media Library, and rewrites the markup to your local copy at the same size it referenced, so your layout is unchanged.<\/p>\n\n This plugin does not<\/strong> phone home and does not<\/strong> send your data to any third party. There are no analytics, no tracking and no external API calls. The only<\/em> outbound requests it makes are to the image URLs that already appear in your own<\/em> content, purely to download those images into your Media Library. Nothing about your site, content or visitors is transmitted anywhere else.<\/p>\n\n All filters use the No - this is a core safety behaviour. Every download is verified to be a genuine, decodable image of the expected MIME type before any URL is rewritten. If the downloaded file is not a real image (for example a geo-blocked placeholder page or an error document), it is discarded and your original external URL is left exactly as it was. A broken local copy is never put in place of a URL that was working.<\/p><\/dd>\n Yes. A single save hook ( Yes. It runs per site, so each site's external images are imported into that site's own Media Library.<\/p><\/dd>\n They are preserved. The plugin only rewrites image URLs and remaps the attachment ID stored in Gutenberg blocks; it does not touch your alt text, captions or any other attributes.<\/p><\/dd>\n JPEG, PNG, GIF, WebP, AVIF and BMP. SVG and ICO are excluded by default for security (SVG can embed script, and ICO is a common smuggling vector). If you fully trust your sources you can extend the allowed set via the No. The plugin uses no external services and contains no tracking or analytics. The only<\/em> outbound HTTP requests it makes are to the image URLs that already exist in your own content, purely to download those images into your local Media Library.<\/p><\/dd>\n It imports the full-size original<\/strong>. WordPress content usually references a scaled<\/em> image (for example No. Before downloading, the plugin checks whether the image already exists in your Media Library and reuses it:<\/p>\n\n Point 2 is the important one for the dev-to-live workflow: if the destination already has the images (for example the page was partly built on live before), they are reused instead of re-uploaded as duplicates. Matching is on the exact stored-file basename, and only when a single unambiguous match exists, so an unrelated image is never picked. Turn filename reuse off with the Add the domain to the whitelist with the Yes - that is a core design goal. The built-in SSRF guard blocks requests to private, reserved, loopback, link-local, ULA and CGNAT addresses, plus the cloud metadata endpoint, and requires every resolved IP of a host to be public before any fetch happens.<\/p><\/dd>\n\n<\/dl>\n\n\n\n
The dev-to-live problem this solves<\/h4>\n\n
https:\/\/dev.example.com\/...<\/code>, so your production pages silently load images from staging. If the source environment is private, password-protected or taken down after launch, those images break.<\/p>\n\nKey features<\/h4>\n\n
\n
Security<\/h4>\n\n
\n
169.254.169.254<\/code>. All<\/em> resolved A\/AAAA records must be public.<\/li>\nhttp<\/code> and https<\/code>, only ports 80<\/code> and 443<\/code>, and URLs containing embedded credentials (user:pass@<\/code>) are refused.<\/li>\nHow it works<\/h4>\n\n
\n
photo-1024x670.webp<\/code>), the plugin fetches the full original and lets WordPress regenerate every registered size locally, then points the markup at the matching local size.<\/li>\nwp auei localise<\/code> to sweep content that was saved before<\/em> the plugin was active, with --dry-run<\/code>, --post_type<\/code>, --post_id<\/code> and --limit<\/code> options.<\/li>\n<\/ul>\n\nWhat it scans<\/h4>\n\n
\n
src<\/code>, data-src<\/code> and data-lazy-src<\/code> attributes<\/li>\nsrcset<\/code> (every candidate, with width and density descriptors)<\/li>\nurl<\/code> \/ src<\/code> \/ href<\/code>)<\/li>\nbackground-image: url(...)<\/code> in inline styles<\/li>\n<\/ul>\n\nCompatibility<\/h4>\n\n
\n
wp_insert_post_data<\/code>) covers both.<\/li>\nPrivacy and external connections<\/h4>\n\n
Filters and Hooks<\/h3>\n\n
auei_<\/code> prefix.<\/p>\n\n\n
auei_enabled<\/code> (bool, default true<\/code>) - master on\/off switch for the whole plugin.<\/li>\nauei_whitelisted_domains<\/code> (string[], default empty) - domains whose images are never imported (left as external), for example a trusted CDN.<\/li>\nauei_import_full_size<\/code> (bool, default true<\/code>) - import the full-size original (strip a -WxH<\/code> scaled suffix) so the destination regenerates every size. Set to false to import only the exact file referenced.<\/li>\nauei_remap_ids<\/code> (bool, default true<\/code>) - rewrite the source-site attachment ID in Gutenberg blocks (\"id\":N<\/code> \/ wp-image-N<\/code>) to the new local attachment ID.<\/li>\nauei_allowed_extensions<\/code> (string[], default jpg, jpeg, png, gif, webp, avif, bmp<\/code>) - image extensions eligible for import. svg<\/code> and ico<\/code> are excluded by default.<\/li>\nauei_allowed_schemes<\/code> (string[], default http, https<\/code>) - URL schemes permitted for fetching.<\/li>\nauei_allowed_ports<\/code> (int[], default 80, 443<\/code>) - explicit ports permitted on a target URL.<\/li>\nauei_blocked_ip_ranges<\/code> (string[], default empty) - extra CIDR ranges to block, in addition to the built-in private\/reserved set.<\/li>\nauei_max_file_size<\/code> (int, default 8388608<\/code>, i.e. 8 MB) - maximum download size in bytes; larger files are rejected.<\/li>\nauei_download_timeout<\/code> (int, default 20<\/code>) - download timeout in seconds.<\/li>\nauei_max_redirects<\/code> (int, default 3<\/code>) - maximum HTTP redirects to follow; every hop is re-validated by the SSRF guard.<\/li>\nauei_reuse_by_filename<\/code> (bool, default true<\/code>) - reuse an existing Media Library image with the same filename (any attachment, not just ones this plugin imported) instead of downloading a duplicate. Matched on the exact stored-file basename.<\/li>\nauei_allow_url<\/code> (true or WP_Error, default validator result) - final override on a per-URL basis; return true<\/code> to force-allow or a WP_Error<\/code> to force-block.<\/li>\nauei_force_logging<\/code> (bool, default false<\/code>) - force debug logging even when WP_DEBUG<\/code> is off.<\/li>\n<\/ul>\n\n\n\n
nerdcow-external-image-importer<\/code> folder to wp-content\/plugins\/<\/code>, or install the plugin through the Plugins > Add New<\/strong> screen.<\/li>\nwp auei localise --dry-run<\/code> to preview, then wp auei localise<\/code> to apply.<\/li>\n<\/ol>\n\n\n\n
Will it ever replace a working image with a broken one?<\/h3><\/dt>\n
Does it work with the Block editor and the Classic editor?<\/h3><\/dt>\n
wp_insert_post_data<\/code>) covers both the Block (Gutenberg) editor - which saves via the REST API - and the Classic editor.<\/p><\/dd>\nDoes it work on multisite?<\/h3><\/dt>\n
What happens to alt text and captions?<\/h3><\/dt>\n
Which image formats are supported?<\/h3><\/dt>\n
auei_allowed_extensions<\/code> filter, but doing so is at your own risk.<\/p><\/dd>\nDoes it send my data anywhere?<\/h3><\/dt>\n
Which image size does it import, and what happens to the block in the editor?<\/h3><\/dt>\n
photo-1024x670.webp<\/code>); the plugin strips that -WxH<\/code> suffix, fetches the full original, and lets WordPress regenerate every registered size locally - so you have the thumbnail, medium, large and full versions, just like a normal upload. The image in your content is then rewritten to the local copy at the same size it referenced<\/strong>, so the layout is unchanged. It also remaps the attachment ID stored in the block (\"id\":N<\/code> \/ wp-image-N<\/code>) to the new local attachment, so the editor's image controls keep working and no stale or colliding source ID is left behind. Both behaviours can be turned off with the auei_import_full_size<\/code> and auei_remap_ids<\/code> filters.<\/p><\/dd>\nWill it re-download images it has already imported?<\/h3><\/dt>\n
\n
_auei_source_url<\/code> post meta); and<\/li>\nauei_reuse_by_filename<\/code> filter if you prefer always-fresh imports.<\/p><\/dd>\nHow do I keep images from a trusted CDN or partner as external?<\/h3><\/dt>\n
auei_whitelisted_domains<\/code> filter. Whitelisted domains are never imported and their URLs are left untouched.<\/p><\/dd>\nIs it safe to run on a server behind a private network?<\/h3><\/dt>\n
1.0.1<\/h4>\n\n
\n
1.0.0<\/h4>\n\n
\n
\"id\":N<\/code> \/ wp-image-N<\/code>) to the new local attachment ID, so blocks never point at a stale or colliding ID on the destination.<\/li>\n_auei_source_url<\/code> meta and (optionally) by previously-imported filename to avoid re-downloading.<\/li>\nsrc<\/code>, data-src<\/code>, data-lazy-src<\/code>, srcset<\/code>, Gutenberg block JSON and CSS background-image<\/code>.<\/li>\nwp auei localise<\/code> WP-CLI command with --dry-run<\/code>, --post_type<\/code>, --post_id<\/code> and --limit<\/code> options for retroactive fixes.<\/li>\nauei_*<\/code> filter set for whitelisting, allowed types, schemes and ports, caps and overrides.<\/li>\n<\/ul>","raw_excerpt":"Automatically import external and remote images into your Media Library on save and rewrite the URLs to local copies. Built SSRF-safe.","jetpack_sharing_enabled":true,"_links":{"self":[{"href":"https:\/\/wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin\/336996","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin"}],"about":[{"href":"https:\/\/wordpress.org\/plugins\/wp-json\/wp\/v2\/types\/plugin"}],"replies":[{"embeddable":true,"href":"https:\/\/wordpress.org\/plugins\/wp-json\/wp\/v2\/comments?post=336996"}],"author":[{"embeddable":true,"href":"https:\/\/wordpress.org\/plugins\/wp-json\/wporg\/v1\/users\/nerdcow"}],"wp:attachment":[{"href":"https:\/\/wordpress.org\/plugins\/wp-json\/wp\/v2\/media?parent=336996"}],"wp:term":[{"taxonomy":"plugin_section","embeddable":true,"href":"https:\/\/wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin_section?post=336996"},{"taxonomy":"plugin_tags","embeddable":true,"href":"https:\/\/wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin_tags?post=336996"},{"taxonomy":"plugin_category","embeddable":true,"href":"https:\/\/wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin_category?post=336996"},{"taxonomy":"plugin_contributors","embeddable":true,"href":"https:\/\/wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin_contributors?post=336996"},{"taxonomy":"plugin_business_model","embeddable":true,"href":"https:\/\/wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin_business_model?post=336996"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}