That button is added next to Add Media via the media_buttons<\/code> hook, which only the classic editor fires. In the block editor, use the \"Photo Directory\" tab inside the native media picker instead \u2014 it opens the same way from Set Featured Image, Add Media, or an Image block's Media Library button.<\/p><\/dd>\nCan I choose what size image gets imported?<\/h3><\/dt>\nYes. Both the Media > Photo Directory browse screen and the media picker tab let you choose Full, Large, or Medium before importing.<\/p><\/dd>\n
Can imported photos be converted to WebP or AVIF?<\/h3><\/dt>\nYes, if your server's image editor supports it. Go to Settings > Photo Directory<\/strong> to choose \u2014 WebP is used automatically whenever your server can produce it. If it can't, the page says so plainly and photos keep their original format. A quality field appears alongside the format choice whenever WebP or AVIF is selected; it has no effect when keeping the original format, so it's hidden in that case.<\/p><\/dd>\nWhere does the plugin store which photos I've already imported?<\/h3><\/dt>\nEach imported attachment gets a _photofetch_source_id<\/code> meta value matching its ID on the Photo Directory. Importing the same photo again returns the existing attachment instead of downloading a duplicate.<\/p><\/dd>\n\n<\/dl>\n\n\n2.0.0<\/h4>\n\n
Renamed the plugin from \"Photo Directory Importer\" to \"PhotoFetch.\" Unlike the 1.3.16 rename, this one is a full internal rebrand, not just the public-facing name:\n* Main plugin file renamed from photo-directory-importer.php<\/code> to photofetch.php<\/code>; every includes\/class-pdi-*.php<\/code> file renamed to includes\/class-photofetch-*.php<\/code>; the bundled .pot<\/code> file renamed to languages\/photofetch.pot<\/code>.\n* The Text Domain<\/code> (and every translation call's domain argument) changed from photo-directory-importer<\/code> to photofetch<\/code>, matching the new slug \u2014 same requirement as the 1.3.14 and 1.3.16 fixes.\n* Unlike 1.3.16, this time the internal-only identifiers were deliberately included: all PDI_*<\/code> class names (PDI_API<\/code>, PDI_Importer<\/code>, PDI_Plugin<\/code>, PDI_Settings<\/code>) are now PhotoFetch_API<\/code>, PhotoFetch_Importer<\/code>, PhotoFetch_Plugin<\/code>, PhotoFetch_Settings<\/code>; the PDI_*<\/code> constants are now PHOTOFETCH_*<\/code>; every pdi_<\/code>-prefixed hook, filter, nonce, AJAX action, option, and meta key (including the _pdi_source_id<\/code>\/_pdi_source_url<\/code>\/_pdi_source_author<\/code>\/_pdi_imported<\/code> attachment meta) is now photofetch_<\/code>-prefixed; and every pdi-*<\/code> CSS class, script\/style handle, and HTML id is now photofetch-*<\/code>.\n* This is a breaking change for existing installs: deactivate and remove the old plugin, then install this one fresh. Site functionality and every imported photo's existing attachment meta are otherwise unaffected \u2014 only the identifiers above changed, not what they do.<\/p>\n\n1.3.17<\/h4>\n\n\n- Fixed the phpcs findings from a fresh run against the renamed plugin:\nan equals-sign alignment warning in
class-pdi-plugin.php<\/code>'s author-link\nrewriter, missing short descriptions in three doc comments (one each in\n class-pdi-importer.php and class-pdi-settings.php<\/code>, two total in the\nlatter), and languages\/index.php<\/code>'s file comment switched from a \/\/<\/code>\nline comment to the required \/** ... *\/<\/code> docblock style.<\/li>\n<\/ul>\n\n1.3.16<\/h4>\n\n\n- Renamed the plugin from \"WP Photo Directory Importer\" to \"Photo\nDirectory Importer\" \u2014 WordPress.org's plugin guidelines prohibit \"WP\" or\n\"WordPress\" in a plugin's name, since it implies an official affiliation\nthe plugin doesn't have. This touched everything tied to the old name:\nthe
Plugin Name<\/code> header, the main plugin file\n(wp-photo-directory-importer.php<\/code> \u2192 photo-directory-importer.php<\/code>),\nthe Text Domain<\/code> (and every translation call's domain argument, to\nmatch \u2014 same requirement as the 1.3.14 fix), the bundled .pot<\/code> file's\nname and contents, and the @package<\/code> docblock tag across every PHP\nfile. Internal-only identifiers (the PDI_*<\/code> class names, pdi_<\/code>-\nprefixed hooks\/filters\/nonces, pdi-*<\/code> CSS\/JS handles) were left\nuntouched, since none of them spell out \"WP\" or \"WordPress\" and\nchanging them would be an unrelated, unnecessary breaking change.<\/li>\n<\/ul>\n\n1.3.15<\/h4>\n\n\n- Fixed incorrect plural handling in the browse screen and media-picker\ntab: several \"N selected\"\/\"N imported\" strings picked between exactly\ntwo hardcoded forms using a
count === 1<\/code> check in JavaScript \u2014 correct\nfor English, but impossible for a translator to adapt to a language\nwith three, four, or six plural forms (Russian, Polish, and Arabic,\namong others). Now uses wp.i18n._n()<\/code>, which consults the current\nlocale's real plural-forms rule instead. Along the way this also fixed\na visible English-language bug: the single-photo \"quick import\" success\nmessage was using the plural template with the count hardcoded to 1,\nproducing \"1 photos imported.\"<\/li>\n- Added a bundled
.pot<\/code> file (languages\/photo-directory-importer.pot<\/code>)\nand a Domain Path<\/code> header, so translators have a starting point instead\nof needing to generate one themselves before they can begin.<\/li>\n<\/ul>\n\n1.3.14<\/h4>\n\n\n- Fixed a Plugin Check error: \"Mismatched text domain. Expected\n'photo-directory-importer' but got 'pdi'.\" WordPress.org requires the\n Text Domain header, and every translation function's domain argument,\nto exactly match the plugin's own folder\/slug. Changed the domain from\n pdi to
photo-directory-importer<\/code> everywhere: the plugin header\nand all translation function calls across every PHP and JS file.\nInternal-only identifiers that happen to start with pdi_<\/code> (hooks,\nfilters, nonces, meta keys, transient keys) were deliberately left\nuntouched, since those aren't text domains.<\/li>\n- Reformatted a handful of PHP statements that became excessively long\npurely from the domain string's length.<\/li>\n<\/ul>\n\n
1.3.12<\/h4>\n\n\n- On the Plugins list page, each contributor's name now links to their\nown wordpress.org profile (
https:\/\/profiles.wordpress.org\/username<\/code>)\ninstead of the whole comma-separated author list linking to one shared\nGitHub URL \u2014 the standard plugin header format only supports one link\nfor the entire \"Author\" string, so this rewrites the row directly via\nthe all_plugins<\/code> filter.<\/li>\n- Added a \"Settings\" link to the plugin's row on the Plugins page,\nappearing first among the action links, right next to \"Deactivate\".<\/li>\n<\/ul>\n\n
1.3.11<\/h4>\n\n\n- Added a quality field to Settings > Photo Directory<\/strong>, shown only\nwhen converting to WebP or AVIF (hidden automatically when \"Keep\noriginal format\" is selected \u2014 quality has no meaning there, since\nnothing gets re-encoded). Defaults to 82, matching WordPress core's own\ndefault JPEG compression quality. Clamped to 1\u2013100 on save regardless\nof what's posted.<\/li>\n<\/ul>\n\n
1.3.10<\/h4>\n\n\n- Added a Settings > Photo Directory<\/strong> page. If this server's image\neditor (GD or Imagick, whichever core picked) can actually produce\nWebP \u2014 checked live via
wp_image_editor_supports()<\/code>, not assumed from\nPHP version or extension presence \u2014 a format picker appears: keep the\noriginal format, convert to WebP, or convert to AVIF (the latter only\noffered when supported too). WebP is the default whenever it's\navailable. If WebP isn't supported, the page simply says so and no\nphotos are converted, same as before this release.<\/li>\n- Conversion happens right after download, before the file is sideloaded,\nso every generated thumbnail\/medium\/large sub-size is produced from the\nconverted file directly rather than converted a second time after the\nfact.<\/li>\n
- A conversion failure for any reason falls back to importing the\noriginal file untouched \u2014 this is meant to be a nice-to-have, never\nsomething that can turn a failed conversion into a failed import.<\/li>\n
- The \"Import settings\" link in the Media > Photo Directory page header,\npresent but hidden since 1.3.4, now points at the new settings page.<\/li>\n<\/ul>\n\n
1.3.9<\/h4>\n\n\n- Added
w.org<\/code> to the default trusted image hosts (pdi_allowed_image_hosts<\/code>).\nThe Photo Directory serves its images from pd.w.org<\/code> specifically \u2014\n w.org is WordPress.org's own short domain, the same family as\n s.w.org, its well-known static-assets host. The 1.3.8 fix (adding\n wp.com for Photon) turned out not to be where these images actually\nlive; this corrects it based on the real rejected host.<\/li>\n<\/ul>\n\n1.3.8<\/h4>\n\n\n- Fixed a regression from 1.3.7 that broke every import.<\/strong> The trusted-host\ncheck added in 1.3.7 only allowed
wordpress.org<\/code> (and its subdomains),\nbut the Photo Directory serves uploaded images through Automattic's\nPhoton CDN (i0.wp.com<\/code>, i1.wp.com<\/code>, etc.) rather than from\nwordpress.org's own domain directly \u2014 so every single import was\nrejected as \"untrusted.\" wp.com<\/code> (and its subdomains) is now included\nin the default allowed hosts.<\/li>\n- The \"not on a trusted host\" error message now includes the actual\nrejected hostname, so a similar mismatch in the future is immediately\ndiagnosable without digging through network requests, and can be\nresolved on the spot via the
pdi_allowed_image_hosts<\/code> filter.<\/li>\n<\/ul>\n\n1.3.7<\/h4>\n\n
Security review and hardening. No user-facing behavior changes; all four\nitems below were fixed as defense-in-depth rather than in response to an\nexploited vulnerability.<\/p>\n\n
\n- Sideloaded image URLs are now pinned to a trusted host.<\/strong>\n PDI_Importer::import_photo() downloads whichever image URL the Photo\nDirectory API returns for a photo; that URL is data returned by<\/em> the\nAPI, not something this plugin generates itself. Added\n is_allowed_image_host(), checked before
download_url()<\/code> is ever\ncalled, requiring the URL's host to be wordpress.org<\/code> or a subdomain of\nit (filterable via pdi_allowed_image_hosts<\/code>). Nothing a site visitor or\nlower-privileged user supplies can influence which host this plugin\ntalks to for search or photo lookups \u2014 those always go to the hardcoded\n REMOTE_BASE\/TAXONOMY_BASE<\/code> constants \u2014 so this specifically guards\nagainst a compromised or malicious upstream API response causing this\nsite to download and store a file from an attacker-controlled server.<\/li>\n- Removed an unused
innerHTML<\/code> code path.<\/strong> assets\/js\/admin.js<\/code>'s el()<\/code>\nhelper had a dead 'html'<\/code> attribute branch (e.innerHTML = attrs.html<\/code>)\nthat nothing in the codebase called, but that would become an XSS sink\nthe moment anything did. Removed it entirely.<\/li>\n- Added
rel=\"noopener noreferrer\"<\/code><\/strong> to the \"View in Media Library\"\nlink in assets\/js\/admin.js<\/code>, which opens in a new tab\n(target=\"_blank\"<\/code>). Its destination is fully server-generated today, so\nthis wasn't exploitable, but it's standard, zero-cost protection against\nreverse-tabnabbing regardless.<\/li>\n- Added explicit
return<\/code> statements after every wp_send_json_error()<\/code>\ncall<\/strong> in class-pdi-api.php<\/code> (ajax_search()<\/code>, ajax_terms()<\/code>) and\n class-pdi-importer.php (ajax_import()<\/code>) that wasn't already the last\nstatement in its function. wp_send_json_error()<\/code> calls wp_die()<\/code>,\nwhich WordPress's AJAX handling turns into an immediate die()<\/code>, so\nexecution already halted in normal operation \u2014 this wasn't currently\nexploitable. But code after those calls was relying on that implicit\nbehavior instead of stating it, which would fall through with\ninvalid\/stale state (e.g. continuing with a photo ID of 0, or treating a\n WP_Error object as an array) if wp_die()<\/code>'s behavior were ever\nfiltered, as some testing harnesses deliberately do.<\/li>\n<\/ul>\n\n1.3.6<\/h4>\n\n\n- Added a \"View full\" button to the \"Photo Directory\" tab inside the\nnative media picker (Set Featured Image, Add Media, etc.), next to the\n\"Import only\" button in the footer. Opens the currently-detailed\nphoto's full-size image in a plain, image-only overlay (closes on\nEscape, clicking outside the image, or the close button).<\/li>\n<\/ul>\n\n
1.3.5<\/h4>\n\n\n- Added a \"View full\" button to every photo card on the Media > Photo\nDirectory browse screen. Opens the photo's full-size image in a\nlightbox (closes on Escape or clicking outside the image), which\nincludes its own Import button (or a \"View in library\" link, once the\nphoto has been imported).<\/li>\n<\/ul>\n\n
1.3.4<\/h4>\n\n\n- Rebuilt Media > Photo Directory<\/strong> as a filterable browse screen\n(
assets\/js\/photo-browser.js<\/code>, React via wp-element<\/code>): category,\norientation, and color filters populated live from the Photo\nDirectory's own taxonomies; sort by relevance or newest; multi-select\nwith a bulk-import tray; per-photo title\/alt\/caption edits and a\nphotographer-credit toggle before import.<\/li>\n- Rebuilt the \"Photo Directory\" tab inside the native media picker as a\ntwo-pane picker (thumbnail grid + detail sidebar) with the same\nfilters, matching the browse screen.<\/li>\n
- Photos already in the Media Library are now flagged in bulk for a\nwhole result page at once (
PDI_Importer::find_existing_attachments()<\/code>)\ninstead of one lookup per card.<\/li>\n_embed<\/code> now requests only the two relations the plugin reads\n(author,wp:featuredmedia<\/code>) instead of every relation the API would\notherwise expand, avoiding an unnecessary wp:term<\/code> expansion per\ntaxonomy per photo.<\/li>\n- Title fallback now prefers a short title derived from the photo's own\ndescription over a humanized slug, since most Photo Directory slugs are\nopaque hex strings (e.g.
6836a813f7<\/code>) with no human meaning to\nhumanize in the first place.<\/li>\n- Normalized photo data now includes width, height, MIME type, and file\nsize, and the computed credit line is available directly on the photo\nobject for the new UI to prefill.<\/li>\n
- Added Michelle Frechette as a contributor.<\/li>\n
- Removed the bundled
LICENSE<\/code> file in favor of linking the license\nonline.<\/li>\n- Fixed the search field's icon overlapping its placeholder text.<\/li>\n<\/ul>\n\n
1.3.3<\/h4>\n\n\n- Sanitize untrusted fields from the Photo Directory API before use: the\nslug now goes through
sanitize_title()<\/code>, the author name through\n wp_strip_all_tags()\/trim()<\/code>, and every image URL through\n esc_url_raw().<\/li>\n- Moved the
wp-admin\/includes\/{media,file,image}.php<\/code> requires from\nfile scope into import_photo()<\/code> itself, so they're only parsed while\nan import is actually happening rather than on every page load\n(this file loads on every request via plugins_loaded<\/code>, including the\nfront end).<\/li>\n- Fixed a phpcs suppression bug: the slow-query warning for\n meta_key\/
meta_value<\/code> was suppressed with a single phpcs:ignore<\/code>\ncomment, which only covers the next line and so didn't actually\nsuppress the meta_value<\/code> warning. Switched to phpcs:disable<\/code>\/\n phpcs:enable spanning both lines.<\/li>\n- Fixed invalid XML in
phpcs.xml.dist<\/code> \u2014 an unescaped --<\/code> inside an XML\ncomment (--dev<\/code>) is illegal in XML and would cause strict parsers to\nreject the whole ruleset file.<\/li>\n- Added gusteci to the plugin's Author\/Contributors list.<\/li>\n<\/ul>\n\n
1.3.2<\/h4>\n\n\n- Alt text now falls back to the same description text used for the\nDescription field, rather than a separate excerpt-only source that was\nfrequently empty even when the description itself had usable text.<\/li>\n
- Reverted the 1.3.1 Caption\/Description swap: Description (post_content)\ngets the photo's full description text again, and Caption (post_excerpt)\ngoes back to containing only the photographer credit line.<\/li>\n<\/ul>\n\n
1.3.1<\/h4>\n\n\n- Swapped the Caption\/Description field mapping: Caption (post_excerpt)\nnow gets the photo's full description text, and Description\n(post_content) gets only the photographer credit line.<\/li>\n
- Removed the (often meaningless, slug-derived) title text from the\nsearch\/browse picker grid. The title is still set on import; it's just\nno longer shown while browsing.<\/li>\n<\/ul>\n\n
1.3.0<\/h4>\n\n\n- Alt text now falls back to the photo's excerpt specifically, rather than\nits (potentially much longer) content\/description.<\/li>\n
- The Caption field (post_excerpt) now contains only the photographer\ncredit line; description text no longer appears in both the Description\nand Caption fields.<\/li>\n<\/ul>\n\n
1.2.3<\/h4>\n\n\n- Alt text now falls back to the photo's description when the upstream\nAPI doesn't expose a dedicated alt-text field of its own \u2014 that appears\nto be the closest thing to alt text the Photo Directory API offers.<\/li>\n<\/ul>\n\n
1.2.2<\/h4>\n\n\n- Alt text was coming through empty for photos that, per direct testing,\ndo have alt text upstream \u2014 the embedded-featured-media lookup this\nplugin relied on apparently isn't where the Photo Directory's custom\npost type actually stores it. Added speculative fallback checks\n(
alt_text<\/code> and meta.alt_text<\/code>\/meta._wp_attachment_image_alt<\/code> on the\nitem itself) pending confirmation against a real API response.<\/li>\n<\/ul>\n\n1.2.1<\/h4>\n\n\n- The upstream Photo Directory substitutes a generic placeholder title\n(e.g. \"Photo Detail\") for photos the uploader never titled. That\nplaceholder is now recognized and treated as no title, with a fallback\ntitle derived from the photo's slug instead (e.g.
red-fox-in-snow<\/code> \u2192\n\"Red fox in snow\") rather than importing the literal placeholder text.\nFilterable via pdi_generic_title_placeholders<\/code>.<\/li>\n<\/ul>\n\n1.2.0<\/h4>\n\n\n- Fixed a bug where the attachment title was copied into the alt text\nfield whenever the upstream photo had no alt text of its own, so the\ntitle and alt text would end up identical (and, for photos with a\ngeneric placeholder title, both fields would show that placeholder).\nAlt text is now only ever populated from the upstream photo's own alt\ntext, and left blank otherwise.<\/li>\n
- Added a photographer credit line to the imported attachment's caption\nwhen the upstream API exposes an author name.<\/li>\n
- Removed the block editor sidebar panel; the native media modal tab\n(added in 1.1.0) covers the same use case without a separate panel.<\/li>\n<\/ul>\n\n
1.1.0<\/h4>\n\n