Adopts the UploadSleuth name and hardens quarantine, restore, backup, and deletion for WordPress.org directory review.<\/p>","1.0.1":"
Improves dashboard consistency and adds a more useful plain-language guide to scanning and safe cleanup.<\/p>","1.0.0":"
First stable public release with uploads auditing, safe cleanup workflows, Media Library integrity checks, and WP-CLI support.<\/p>","0.16.0":"
Standards and submission-readiness release with hardened AJAX input handling and no intended workflow changes.<\/p>","0.15.4":"
Allows safe multi-dot filenames to be scanned and cleaned without weakening traversal protection.<\/p>","0.15.3":"
Improves spacing around dashboard notices.<\/p>","0.15.2":"
Fixes Delete all for large and stale browser result sets while retaining server-owned validation.<\/p>","0.15.1":"
Keeps operational feedback beside the workflow that produced it instead of at the top of the page.<\/p>","0.15.0":"
Adds a guarded Media Library database-integrity workflow. Review offloaded media carefully before deleting records.<\/p>","0.14.1":"
Corrects checkbox alignment in settings cards.<\/p>","0.14.0":"
Reduces browser memory, DOM, layout, and filtering work for very large result sets.<\/p>","0.13.3":"
Makes browser console diagnostics opt-in to avoid unnecessary client-side work.<\/p>","0.13.2":"
Improves statistics placement and keeps empty counters out of the interface.<\/p>","0.13.1":"
Keeps very large deletion reports from expanding the admin page.<\/p>","0.13.0":"
Adds real file-action progress and tuning controls for slow servers. Revalidation remains enabled by default.<\/p>","0.12.0":"
Adds visible progress feedback to Delete all and other dashboard tasks.<\/p>","0.11.0":"
Adds persistent cleanup and reclaimed-space statistics; tracking begins after this update.<\/p>","0.10.1":"
Fixes authenticated dashboard ZIP downloads returning an error page.<\/p>","0.10.0":"
Adds whole-result deletion and selected\/all quarantine cleanup controls.<\/p>","0.9.2":"
Restores automatic ZIP downloads and makes dashboard dry-run opt-in.<\/p>","0.9.1":"
Fixes ZIP download navigation and filenames.<\/p>","0.9.0":"
Adds guarded quarantine restoration and fixes the remaining file-action page jumps.<\/p>","0.8.0":"
Dashboard backup-and-remove now downloads a verified ZIP and no longer jumps the page during file actions.<\/p>","0.7.0":"
Improves the live scanning and results interface without changing the safety model or filesystem actions.<\/p>","0.6.1":"
Adds developer-facing code documentation without changing scan behavior.<\/p>","0.6.0":"
Adds stoppable batched dashboard scans with preserved partial results.<\/p>","0.5.0":"
Adds last-moment reference validation and WordPress-native standalone-file deletion.<\/p>","0.4.0":"
Adds the complete WP-CLI reference directly to the UploadSleuth dashboard.<\/p>","0.3.0":"
Adds verified backups before removing original files and improved scan diagnostics.<\/p>","0.2.0":"
Adds the AJAX dashboard and safer, more capable WP-CLI workflows. Back up before performing any filesystem action.<\/p>"},"ratings":[],"assets_icons":{"icon-128x128.png":{"filename":"icon-128x128.png","revision":3690073,"resolution":"128x128","location":"assets","locale":"","width":128,"height":128},"icon-256x256.png":{"filename":"icon-256x256.png","revision":3690073,"resolution":"256x256","location":"assets","locale":"","width":256,"height":256}},"assets_banners":{"banner-1544x500.png":{"filename":"banner-1544x500.png","revision":3690073,"resolution":"1544x500","location":"assets","locale":"","width":1544,"height":500},"banner-772x250.png":{"filename":"banner-772x250.png","revision":3690073,"resolution":"772x250","location":"assets","locale":"","width":772,"height":250}},"assets_blueprints":{},"all_blocks":[],"tagged_versions":["1.0.2"],"block_files":[],"assets_screenshots":[],"screenshots":[]},"plugin_section":[],"plugin_tags":[8533,3786,84,85,4574],"plugin_category":[50],"plugin_contributors":[85196],"plugin_business_model":[],"class_list":["post-366260","plugin","type-plugin","status-publish","hentry","plugin_tags-audit","plugin_tags-cleanup","plugin_tags-media","plugin_tags-uploads","plugin_tags-wp-cli","plugin_category-media","plugin_contributors-eboxnet","plugin_committers-eboxnet"],"banners":{"banner":"https:\/\/ps.w.org\/upload-sleuth\/assets\/banner-772x250.png?rev=3690073","banner_2x":"https:\/\/ps.w.org\/upload-sleuth\/assets\/banner-1544x500.png?rev=3690073","banner_rtl":false,"banner_2x_rtl":false},"icons":{"svg":false,"icon":"https:\/\/ps.w.org\/upload-sleuth\/assets\/icon-128x128.png?rev=3690073","icon_2x":"https:\/\/ps.w.org\/upload-sleuth\/assets\/icon-256x256.png?rev=3690073","generated":false},"screenshots":[],"raw_content":"\n
UploadSleuth reconciles files in the uploads directory against WordPress attachment metadata and database references.<\/p>\n\n
Files without a detected reference are shown as likely stray candidates. They are not declared safe to delete. The plugin encourages a review, dry-run, and quarantine workflow before permanent removal.<\/p>\n\n
wp_delete_file()<\/code>.<\/li>\n- Stoppable batched scans that preserve reviewed partial findings.<\/li>\n
- Separate Media Library integrity checks for missing originals and generated image sizes.<\/li>\n
- WordPress-native cleanup of reviewed missing-file attachment records.<\/li>\n
- No external service or telemetry.<\/li>\n<\/ul>\n\n
Important safety note<\/h4>\n\n
A file can be referenced by an external system, theme or plugin code, encoded data, a custom database, or another location the plugin cannot inspect. Make a verified backup and test quarantined files before deleting anything permanently.<\/p>\n\n
WP-CLI Examples<\/h3>\n\nwp upload-sleuth\n\nwp upload-sleuth --uploads-subdir=2025 --format=json\n\nwp upload-sleuth --older-than=90 --min-size=100 --summary-only\n\nwp upload-sleuth --quarantine --dry-run\n\nwp upload-sleuth --delete --dry-run\n\nwp upload-sleuth --backup-delete --dry-run\n<\/code><\/pre>\n\nReal permanent deletion requires wp upload-sleuth --delete --yes<\/code>. A real backup-and-remove operation similarly requires wp upload-sleuth --backup-delete --yes<\/code>.<\/p>\n\n\n\n- Upload the
upload-sleuth<\/code> directory to \/wp-content\/plugins\/<\/code>.<\/li>\n- Activate UploadSleuth through the Plugins screen.<\/li>\n
- Open Tools > UploadSleuth.<\/li>\n
- Configure ignore patterns or custom table checks if needed.<\/li>\n
- Begin with a narrow subdirectory scan.<\/li>\n<\/ol>\n\n\n
\nDoes a finding mean the file is safe to delete?<\/h3><\/dt>\nNo. A finding means the plugin did not detect a reference in the locations it checked. Treat it as a candidate requiring review.<\/p><\/dd>\n
What does quarantine do?<\/h3><\/dt>\nQuarantine moves selected files into a timestamped directory below the configured quarantine folder while preserving their original relative paths. The quarantine directory is excluded from future scans.<\/p><\/dd>\n
Can I restore a quarantined file?<\/h3><\/dt>\nYes. The Quarantined files panel lists recoverable files and restores each one to its original uploads path. Restore is blocked rather than overwriting a file that already exists there.<\/p>\n\n
The same panel can permanently delete selected quarantined files or all recoverable quarantined files. Downloadable backup ZIPs are not included in Delete all.<\/p><\/dd>\n
What does Download ZIP & remove do?<\/h3><\/dt>\nThe dashboard and WP-CLI create one ZIP, verify every archived entry using its size and SHA-256 hash, and only then remove the originals. The dashboard starts an authenticated download; WP-CLI reports the protected server-side archive path.<\/p><\/dd>\n
Can I preview an action?<\/h3><\/dt>\nYes. Dry-run is an opt-in checkbox in the dashboard. WP-CLI supports --dry-run<\/code> with quarantine or deletion.<\/p><\/dd>\nCan I stop a long scan?<\/h3><\/dt>\nYes. Dashboard scans process database candidates in small batches. Stop finishes the current request, saves everything classified through the latest completed batch, and marks the result as partial. Unprocessed candidates are not included in partial findings.<\/p><\/dd>\n
Does it support ACF?<\/h3><\/dt>\nACF commonly stores values in post, term, user, and options metadata. Those locations are checked. Unusual custom tables can be configured explicitly.<\/p><\/dd>\n
What is the WP-CLI command?<\/h3><\/dt>\nRun wp upload-sleuth<\/code>. Use wp help upload-sleuth<\/code> for all options.<\/p><\/dd>\nHow do I inspect older, larger candidates only?<\/h3><\/dt>\nUse wp upload-sleuth --older-than=90 --min-size=100<\/code> to report candidates older than 90 days and at least 100 KB.<\/p><\/dd>\nCan the command be used in automation?<\/h3><\/dt>\nYes. --summary-only --fail-on-findings<\/code> provides a concise result and a non-zero exit when candidates exist.<\/p><\/dd>\nDoes the plugin send data elsewhere?<\/h3><\/dt>\nNo. Scanning and file operations run locally within WordPress.<\/p><\/dd>\n
Can it find Media Library records whose files are missing?<\/h3><\/dt>\nYes. The Library integrity tab checks attachment records in batches. It reports missing local originals and, separately, generated sizes that are absent while the original exists. Missing-original records can be deleted individually or all at once after confirmation; cleanup uses WordPress wp_delete_attachment()<\/code> rather than direct database queries.<\/p>\n\nSites using S3, CDN, or another media-offload plugin require special care. A valid remote attachment may intentionally have no local file, so confirm the remote object and offload configuration before deleting a reported record.<\/p><\/dd>\n\n<\/dl>\n\n\n
1.0.2<\/h4>\n\n\n- Renamed the plugin to UploadSleuth \u2013 Media Audit & Cleanup and changed the public slug, text domain, package, dashboard URL, and WP-CLI command to
upload-sleuth<\/code>.<\/li>\n- Limited quarantine, restore, backup, and delete actions to file types recognised by WordPress;
--all-files<\/code> now expands reporting only.<\/li>\n- Replaced WP-CLI backup trees with verified ZIP archives.<\/li>\n
- Moved runtime storage below
uploads\/upload-sleuth<\/code>, added direct-access protection files, and stored quarantined files with a non-executable suffix.<\/li>\n- Blocked symbolic links from quarantine and restore operations.<\/li>\n<\/ul>\n\n
1.0.1<\/h4>\n\n\n- Matched the Settings tab width to the other UploadSleuth sections.<\/li>\n
- Expanded the How it works guide with scan stages, result meanings, action guidance, and a pre-cleanup checklist.<\/li>\n<\/ul>\n\n
1.0.0<\/h4>\n\n\n- First stable public release of UploadSleuth.<\/li>\n
- Added uploads auditing with attachment and database-reference checks.<\/li>\n
- Added stoppable AJAX scans, saved partial results, filtering, sorting, and batched actions.<\/li>\n
- Added quarantine, guarded restoration, verified ZIP backup and removal, and permanent cleanup tools.<\/li>\n
- Added Media Library integrity checks for missing originals and generated files.<\/li>\n
- Added slow-server controls, cleanup statistics, WP-CLI workflows, and developer documentation.<\/li>\n
- Passed WordPress coding standards, PHP 7.4 compatibility, and Plugin Check new-submission validation.<\/li>\n<\/ul>\n\n
0.16.0<\/h4>\n\n\n- Applied the WordPress PHP Coding Standards throughout the plugin.<\/li>\n
- Completed PHPDoc parameter and return documentation for every PHP function and method.<\/li>\n
- Documented narrowly scoped database and filesystem exceptions used for safe batching, atomic moves, and streamed ZIP verification.<\/li>\n
- Hardened AJAX array unslashing and sanitization while retaining server-owned finding validation.<\/li>\n
- Modernized and formatted dashboard JavaScript and CSS using the official WordPress lint configurations.<\/li>\n
- Added current WordPress compatibility and release metadata for directory submission.<\/li>\n<\/ul>\n\n
0.15.4<\/h4>\n\n\n- Allowed safe filenames containing consecutive dots.<\/li>\n
- Kept traversal protection for actual current-directory and parent-directory path segments.<\/li>\n
- Unified the corrected path rule across dashboard and WP-CLI workflows.<\/li>\n<\/ul>\n\n
0.15.3<\/h4>\n\n\n- Added consistent spacing above section-level notices.<\/li>\n<\/ul>\n\n
0.15.2<\/h4>\n\n\n- Fixed Delete all validation across batched requests.<\/li>\n
- Preserved whole-result authorization while keeping genuine per-batch progress.<\/li>\n
- Chunked large saved finding sets to avoid object-cache item-size failures.<\/li>\n
- Removed repeated full-result payloads and full-result rewrites during file actions.<\/li>\n
- Added a clear message when saved server findings have expired.<\/li>\n<\/ul>\n\n
0.15.1<\/h4>\n\n\n- Moved AJAX success, warning, and error notices into their related scan, quarantine, integrity, or CLI section.<\/li>\n
- Added reliable dismiss controls for notices created after page load.<\/li>\n<\/ul>\n\n
0.15.0<\/h4>\n\n\n- Added a Library integrity tab for missing local attachment originals and generated sizes.<\/li>\n
- Added batched progress, cooperative stopping, saved partial findings, and incremental rendering.<\/li>\n
- Added selected\/all attachment-record cleanup through
wp_delete_attachment()<\/code> with immediate original rechecks.<\/li>\n- Added explicit media-offload warnings and accurate statistics for generated files removed by WordPress.<\/li>\n
- Reduced repeated AJAX payload size during large integrity checks.<\/li>\n<\/ul>\n\n
0.14.1<\/h4>\n\n\n- Aligned settings checkboxes with their first text line.<\/li>\n<\/ul>\n\n
0.14.0<\/h4>\n\n\n- Added incremental findings and action-report rendering with Load more controls.<\/li>\n
- Added a configurable rows-per-view setting, defaulting to 250.<\/li>\n
- Debounced result filtering and reduced DOM layout\/paint work.<\/li>\n
- Kept complete datasets available for whole-result actions without rendering every row.<\/li>\n
- Avoided duplicating the complete findings array during ordinary renders.<\/li>\n<\/ul>\n\n
0.13.3<\/h4>\n\n\n- Added opt-in browser console diagnostics, disabled by default.<\/li>\n
- Disabled heartbeat timers and diagnostic payload construction while logging is off.<\/li>\n
- Capped enabled file-action console samples at 100 rows.<\/li>\n<\/ul>\n\n
0.13.2<\/h4>\n\n\n- Moved Storage Impact above the scan controls.<\/li>\n
- Kept cleanup statistics hidden until tracked activity exists.<\/li>\n<\/ul>\n\n
0.13.1<\/h4>\n\n\n- Constrained large per-file reports to a keyboard-accessible fixed-height scroll area.<\/li>\n
- Added a visible action-result count.<\/li>\n<\/ul>\n\n
0.13.0<\/h4>\n\n\n- Batched delete, Delete all, and quarantine actions with genuine progress.<\/li>\n
- Added scan batch, file-action batch, and inter-batch pause settings.<\/li>\n
- Made last-moment reference revalidation optional but enabled by default.<\/li>\n
- Kept saved-finding and path validation active when revalidation is disabled.<\/li>\n<\/ul>\n\n
0.12.0<\/h4>\n\n\n- Added inline operation progress for all dashboard filesystem actions.<\/li>\n
- Added dedicated progress feedback for quarantine loading, restore, and selected\/all deletion.<\/li>\n
- Displayed queued file counts without fabricating percentages for one-request operations.<\/li>\n
- Added accessible busy\/live states without moving the viewport.<\/li>\n<\/ul>\n\n
0.11.0<\/h4>\n\n\n- Added a persistent Storage Impact dashboard section.<\/li>\n
- Counted reclaimed bytes only after successful permanent removal.<\/li>\n
- Added cumulative permanent-removal, quarantine, and restore counters.<\/li>\n
- Included quarantine cleanup in reclaimed-space totals.<\/li>\n<\/ul>\n\n
0.10.1<\/h4>\n\n\n- Fixed HTML-escaped query separators causing valid ZIP downloads to reach a missing\/invalid endpoint.<\/li>\n<\/ul>\n\n
0.10.0<\/h4>\n\n\n- Added Delete all findings for the complete saved result set.<\/li>\n
- Added quarantine selection plus permanent Delete selected and Delete all controls.<\/li>\n
- Excluded ZIP and CLI backup artifacts from quarantine deletion.<\/li>\n
- Used WordPress-native file deletion with explicit confirmations for quarantine cleanup.<\/li>\n<\/ul>\n\n
0.9.2<\/h4>\n\n\n- Replaced the browser-blocked hidden-frame ZIP transfer with a named attachment download.<\/li>\n
- Made dashboard dry-run opt-in; destructive removal actions still require confirmation.<\/li>\n<\/ul>\n\n
0.9.1<\/h4>\n\n\n- Isolated ZIP downloads so they cannot move or navigate the admin page.<\/li>\n
- Preserved timestamped UploadSleuth archive filenames instead of the download endpoint name.<\/li>\n<\/ul>\n\n
0.9.0<\/h4>\n\n\n- Added an in-dashboard quarantine inventory with guarded one-click restoration.<\/li>\n
- Blocked restoration when the original uploads path is already occupied.<\/li>\n
- Clarified quarantine behavior beside the file actions.<\/li>\n
- Prevented notices, focused buttons, and progress visibility from moving the viewport during actions.<\/li>\n<\/ul>\n\n
0.8.0<\/h4>\n\n\n- Changed the dashboard backup action to create and automatically download one verified ZIP before removing originals.<\/li>\n
- Added an authenticated, short-lived, current-user-only archive download endpoint.<\/li>\n
- Prevented file-action controls and results rerendering from jumping the page to the top.<\/li>\n
- Kept the existing WP-CLI verified backup-directory behavior.<\/li>\n<\/ul>\n\n
0.7.0<\/h4>\n\n\n- Refined dashboard hierarchy, spacing, responsive controls, progress treatment, and results table.<\/li>\n
- Added clear Live, Partial, Limited, and Complete result states with accurate live metric labels.<\/li>\n
- Replaced absolute scan paths with concise uploads-relative scope labels.<\/li>\n
- Kept filtering, sorting, and row selection usable during batched scans.<\/li>\n
- Fixed sticky table headers bleeding into result rows and improved progress accessibility.<\/li>\n<\/ul>\n\n
0.6.1<\/h4>\n\n\n- Added complete PHPDoc to the admin controller and scan-job helpers.<\/li>\n
- Documented JavaScript batching, cancellation, race handling, and trust boundaries.<\/li>\n
- Added a developer architecture guide covering state, safety invariants, and extension hooks.<\/li>\n<\/ul>\n\n
0.6.0<\/h4>\n\n\n- Converted dashboard reference checks to persistent batches of 25 candidates.<\/li>\n
- Added live candidate counts and percentage progress.<\/li>\n
- Added Stop scan with saved, clearly marked partial findings.<\/li>\n
- Allowed dry-run and quarantine review against stopped results.<\/li>\n
- Added race-safe stop markers and 30-minute per-user scan jobs.<\/li>\n<\/ul>\n\n
0.5.0<\/h4>\n\n\n- Revalidate attachment metadata and database references immediately before every action.<\/li>\n
- Block files that became referenced after the scan.<\/li>\n
- Use WordPress
wp_delete_file()<\/code> for standalone-file removal.<\/li>\n- Added lifecycle hooks for quarantine, backup-and-remove, and deletion.<\/li>\n
- Excluded UploadSleuth's own settings and transients from reference matching.<\/li>\n<\/ul>\n\n
0.4.0<\/h4>\n\n\n- Added a CLI Reference dashboard tab.<\/li>\n
- Documented every plugin command option and common global WP-CLI parameters.<\/li>\n
- Added one-click copying for complete command recipes.<\/li>\n<\/ul>\n\n
0.3.0<\/h4>\n\n\n- Added verified Backup & remove actions to the dashboard and WP-CLI.<\/li>\n
- Added live browser-console scan heartbeats and final diagnostic summaries.<\/li>\n
- Added WP-CLI inventory, reference-index, and database-check progress messages.<\/li>\n<\/ul>\n\n
0.2.0<\/h4>\n\n\n- Rebuilt the admin experience with AJAX scanning and file actions.<\/li>\n
- Added result summaries, filtering, sorting, persistent findings, and action reports.<\/li>\n
- Added size and age CLI filters, summary-only and CI modes, guarded deletion, and richer metrics.<\/li>\n
- Hardened path validation and excluded quarantine files from future scans.<\/li>\n
- Added comprehensive project and WordPress.org documentation.<\/li>\n<\/ul>\n\n
0.1.0<\/h4>\n\n\n- Initial release.<\/li>\n<\/ul>","raw_excerpt":"Find files that may be unused in WordPress uploads, spot missing Media Library files, and safely review, quarantine, back up, or delete them.","jetpack_sharing_enabled":true,"_links":{"self":[{"href":"https:\/\/wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin\/366260","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin"}],"about":[{"href":"https:\/\/wordpress.org\/plugins\/wp-json\/wp\/v2\/types\/plugin"}],"replies":[{"embeddable":true,"href":"https:\/\/wordpress.org\/plugins\/wp-json\/wp\/v2\/comments?post=366260"}],"author":[{"embeddable":true,"href":"https:\/\/wordpress.org\/plugins\/wp-json\/wporg\/v1\/users\/eboxnet"}],"wp:attachment":[{"href":"https:\/\/wordpress.org\/plugins\/wp-json\/wp\/v2\/media?parent=366260"}],"wp:term":[{"taxonomy":"plugin_section","embeddable":true,"href":"https:\/\/wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin_section?post=366260"},{"taxonomy":"plugin_tags","embeddable":true,"href":"https:\/\/wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin_tags?post=366260"},{"taxonomy":"plugin_category","embeddable":true,"href":"https:\/\/wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin_category?post=366260"},{"taxonomy":"plugin_contributors","embeddable":true,"href":"https:\/\/wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin_contributors?post=366260"},{"taxonomy":"plugin_business_model","embeddable":true,"href":"https:\/\/wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin_business_model?post=366260"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}