Media Audit (by ROBOTSTXT) git.robotstxt.es

=== Media Audit (by ROBOTSTXT) === Contributors: robotstxt, javiercasares Tags: media, copyright, images, reverse image search, media library Requires at least: 5.3 Tested up to: 7.1 Requires PHP: 8.0 Stable tag: 1.9.0 Version: 1.9.0 License: GPL-3.0-or-later License URI: https://www.gnu.org/licenses/gpl-3.0.txt

Audit your media library for copyright risks: track internal usage, run reverse image search via Google Vision, TinEye, and PicDefense, and classify results against configurable alert and ignored hostname lists.

== Description ==

Media Audit helps site owners and editors understand where their media files are used and whether those files appear elsewhere on the internet — a key signal for detecting potential copyright violations.

= Features =

• Internal usage scan — identifies every post, page, and custom post type that references each attachment as featured image, inline content, or post meta.
• External reverse image search — submits images to Google Cloud Vision (Web Detection) and TinEye Commercial API to find matching pages across the web.
• Consensus detection — surfaces domains independently confirmed by multiple providers, providing stronger copyright-risk signals.
• Audit list — filterable admin page showing each attachment's external scan status, alert classification, and top matching domains.
• Alert management — dedicated Alerts page to review active copyright-risk alerts and dismiss false positives with optional notes. Dismissed alerts are tracked separately and can be reactivated at any time.
• WP-CLI support — run or schedule scans from the command line.
• GDPR compliance — full WordPress privacy API integration for personal data export and erasure on request.
• Async processing — all scanning runs via the bundled Action Scheduler library to avoid blocking web requests (no extra plugin needed).

= Requirements =

• Manager (by ROBOTSTXT) plugin (recommended) — required to receive plugin updates.
• Google Cloud Vision API key (for Web Detection scanning).
• TinEye Commercial API key (for reverse image search).

== Using the plugin ==

= WP-CLI =

Install tables manually (normally handled on activation):

wp mra install

Show current index and scan status:

wp mra status

Run an internal usage scan (queues a batch):

wp mra scan-internal [--batch=]

Run an external reverse image search (queues a batch):

wp mra scan-external [--batch=]

= Extension hooks =

• mra/internal/scanner/post_types — filter the post types included in the internal usage scan.
• mra/internal/scanner/meta_keys — filter the meta keys inspected during the internal scan.
• mra/external/providers — register additional external scan providers.

== Installation ==

= Automatic download =

Visit the plugin section in your WordPress admin, search for "Media Audit"; download and install the plugin.

= Manual download =

Extract the contents of the ZIP and upload the folder to /wp-content/plugins/robotstxt-mediaaudit/. Once uploaded it will appear in your plugin list.

After activation, visit Media Audit → Settings to enter your API credentials.

== Frequently Asked Questions ==

= Do I need both Google Vision and TinEye keys? =

No. The plugin works with either provider configured. Results will only be collected from providers with a valid API key.

= Will scanning slow down my site? =

No. All scans are queued and processed asynchronously by Action Scheduler in small batches.

= What is consensus detection? =

When the same domain appears independently in both Google Vision and TinEye results for the same image, it is flagged as a consensus match — a stronger copyright-risk signal than a single-provider finding.

= Is data deleted when I uninstall? =

By default, no. Enable Settings → Delete data on uninstall if you want all plugin tables and options removed on uninstall.

== Compatibility ==

• WordPress: 5.3 - 7.1
• PHP: 8.0 - 8.5
• WP-CLI: 2.x

== Changelog ==

Only the 3 latest versions. The full changelog is at www.robotstxt.software/plugins/robotstxt-mediaaudit/.

= 1.9.0 =

• Action Scheduler is now bundled via Composer (woocommerce/action-scheduler): the external action-scheduler plugin is no longer required.
• The library self-arbitrates when another plugin (e.g. WooCommerce) loads its own copy — only the newest version initializes.

= 1.8.3 =

• Updates are now delivered through Manager (by ROBOTSTXT): the bundled self-updater (robotstxt-updater.php, update.json) was removed.
• The Plugins page now shows a dismissible notice when Manager is not installed and active, and the Settings page shows a permanent notice until it is.
• New Update URI header pointing to the plugin page at www.robotstxt.software; Plugin and Author URIs updated accordingly.

= 1.8.2 =

• Contribution guidelines restructured: AGENTS.md is now an index to topic-specific AGENTS-*.md files (single source of truth).
• Added bin/preflight.sh automated pre-deploy verification (PHPCS, PHPStan, PHPCompatibility, PHPUnit, composer audit, ZIP inspection).
• Added plugin header tests validating header consistency (Stable tag ↔ Version ↔ version constant).
• Added .claude/settings.json deny rules enforcing no-auto-deploy / no-push / no-tag / no-merge.
• Added .claude/agents/security-auditor.md and .claude/commands/deploy-check.md for clean-context pre-deploy audits.
• Fixed bin/deploy.sh excluding all AGENTS-*.md dev docs from the release ZIP (previously only AGENTS.md).

= Previous versions =

If you want to see the full changelog, visit www.robotstxt.software/plugins/robotstxt-mediaaudit/.

== Compliance ==

This plugin adheres to the following security measures and review protocols for each version:

• WordPress Plugin Handbook
• WordPress Plugin Security
• WordPress APIs Security
• WordPress Coding Standards
• Plugin Check (PCP)