Media Audit (by ROBOTSTXT) WP Registry grade B. Medium-severity findings · 1 findingWP RegistryMedium-severity findings · 1 findingOpen the reportB git.robotstxt.es

Audit your media library for copyright risks: track internal usage, run reverse image search via Google Vision, TinEye, and PicDefense, and classify results against configurable alert and ignored hostname lists.

Description

Media Audit helps site owners and editors understand where their media files are used and whether those files appear elsewhere on the internet — a key signal for detecting potential copyright violations.

Features

• Internal usage scan — identifies every post, page, and custom post type that references each attachment as featured image, inline content, or post meta.
• External reverse image search — submits images to Google Cloud Vision (Web Detection) and TinEye Commercial API to find matching pages across the web.
• Consensus detection — surfaces domains independently confirmed by multiple providers, providing stronger copyright-risk signals.
• Audit list — filterable admin page showing each attachment's external scan status, alert classification, and top matching domains.
• Alert management — dedicated Alerts page to review active copyright-risk alerts and dismiss false positives with optional notes. Dismissed alerts are tracked separately and can be reactivated at any time.
• WP-CLI support — run or schedule scans from the command line.
• GDPR compliance — full WordPress privacy API integration for personal data export and erasure on request.
• Async processing — all scanning runs via the bundled Action Scheduler library to avoid blocking web requests (no extra plugin needed).

Requirements

• Manager (by ROBOTSTXT) plugin (recommended) — required to receive plugin updates.
• Google Cloud Vision API key (for Web Detection scanning).
• TinEye Commercial API key (for reverse image search).

Using the plugin

WP-CLI

Install tables manually (normally handled on activation):

wp mra install

Show current index and scan status:

wp mra status

Run an internal usage scan (queues a batch):

wp mra scan-internal [--batch=]

Run an external reverse image search (queues a batch):

wp mra scan-external [--batch=]

Extension hooks

• mra/internal/scanner/post_types — filter the post types included in the internal usage scan.
• mra/internal/scanner/meta_keys — filter the meta keys inspected during the internal scan.
• mra/external/providers — register additional external scan providers.

Installation

Automatic download

Visit the plugin section in your WordPress admin, search for "Media Audit"; download and install the plugin.

Manual download

Extract the contents of the ZIP and upload the folder to /wp-content/plugins/robotstxt-mediaaudit/. Once uploaded it will appear in your plugin list.

After activation, visit Media Audit → Settings to enter your API credentials.

Frequently Asked Questions

Do I need both Google Vision and TinEye keys?

No. The plugin works with either provider configured. Results will only be collected from providers with a valid API key.

Will scanning slow down my site?

No. All scans are queued and processed asynchronously by Action Scheduler in small batches.

What is consensus detection?

When the same domain appears independently in both Google Vision and TinEye results for the same image, it is flagged as a consensus match — a stronger copyright-risk signal than a single-provider finding.

Is data deleted when I uninstall?

By default, no. Enable Settings → Delete data on uninstall if you want all plugin tables and options removed on uninstall.

Compatibility

• WordPress: 5.3 - 7.1
• PHP: 8.0 - 8.5
• WP-CLI: 2.x

Changelog

Only the 3 latest versions. The full changelog is at www.robotstxt.software/plugins/robotstxt-mediaaudit/.

1.9.0

• Action Scheduler is now bundled via Composer (woocommerce/action-scheduler): the external action-scheduler plugin is no longer required.
• The library self-arbitrates when another plugin (e.g. WooCommerce) loads its own copy — only the newest version initializes.

1.8.3

• Updates are now delivered through Manager (by ROBOTSTXT): the bundled self-updater (robotstxt-updater.php, update.json) was removed.
• The Plugins page now shows a dismissible notice when Manager is not installed and active, and the Settings page shows a permanent notice until it is.
• New Update URI header pointing to the plugin page at www.robotstxt.software; Plugin and Author URIs updated accordingly.

1.8.2

• Contribution guidelines restructured: AGENTS.md is now an index to topic-specific AGENTS-*.md files (single source of truth).
• Added bin/preflight.sh automated pre-deploy verification (PHPCS, PHPStan, PHPCompatibility, PHPUnit, composer audit, ZIP inspection).
• Added plugin header tests validating header consistency (Stable tag ↔ Version ↔ version constant).
• Added .claude/settings.json deny rules enforcing no-auto-deploy / no-push / no-tag / no-merge.
• Added .claude/agents/security-auditor.md and .claude/commands/deploy-check.md for clean-context pre-deploy audits.
• Fixed bin/deploy.sh excluding all AGENTS-*.md dev docs from the release ZIP (previously only AGENTS.md).

Previous versions

If you want to see the full changelog, visit www.robotstxt.software/plugins/robotstxt-mediaaudit/.

Compliance

This plugin adheres to the following security measures and review protocols for each version:

• WordPress Plugin Handbook
• WordPress Plugin Security
• WordPress APIs Security
• WordPress Coding Standards
• Plugin Check (PCP)