WP Manifestindependent plugin directory
manifest / media / wp-media-guard

WP Media Guard

WP Media Guard: WordPress plugin for hotlink protection, automatic thumbnail watermark/blur, and a media upload review workflow. Includes configurable allowlist rules, graceful GD/Imagick fallback, and admin tools to log uploads and approve/reject media.

by WP Media Guard Team · github.com/red-user23/wp-media-guard · website

★ 0stars
0forks

Install

No release zip yet. The repository archive installs, but the folder name will carry the branch suffix and updates will not flow:

wp plugin install https://github.com/red-user23/wp-media-guard/archive/refs/heads/main.zip
Readme github.com/red-user23/wp-media-guard ↗

A comprehensive WordPress plugin for media protection and management.

Version: 0.1.0
Author: Red-User23
Plugin URI: Useful tools
License: GPLv2 or later

Description

WP Media Guard provides three powerful features to protect and manage your WordPress media library:

  1. Hotlink Protection - Prevent other websites from directly linking to your images
  2. Automatic Watermark/Blur - Apply watermarks or blur effects to thumbnail images
  3. Upload Review Workflow - Log and review media uploads before they're published

Features

🔒 Hotlink Protection

  • Blocks unauthorized access to your images from external websites
  • Configurable domain allowlist
  • Optional empty referer handling
  • PHP-level protection (no .htaccess modifications required)
  • Returns 403 Forbidden with custom message
  • Protects JPG, JPEG, PNG, GIF, and WebP images

🖼️ Watermark & Blur

  • Apply watermarks to generated thumbnail images (originals remain untouched)
  • Alternative blur mode for privacy-sensitive images
  • Configurable watermark opacity (0-100%)
  • Five position options: Bottom Right, Bottom Left, Top Right, Top Left, Center
  • Adjustable blur strength (1-10)
  • Supports both Imagick and GD libraries
  • Graceful fallback if no image library is available
  • Custom watermark support

📋 Upload Logging & Review

  • Automatically log all media uploads
  • Track user, timestamp, file name, and MIME type
  • Review queue with pending/approved/rejected status
  • Bulk approve/reject actions
  • Filter by status
  • Media library column with quick actions
  • Configurable default status for images
  • Non-images automatically approved

Requirements

  • WordPress: 6.0 or higher
  • PHP: 8.0 or higher
  • Recommended: Imagick or GD extension for watermark/blur features

Installation

From Plugin Files

  1. Download the plugin files
  2. Upload the wp-media-guard folder to /wp-content/plugins/
  3. Activate the plugin through the 'Plugins' menu in WordPress
  4. Navigate to Settings → WP Media Guard to configure

Manual Installation

  1. Clone this repository into your WordPress plugins directory:
    cd wp-content/plugins
git clone https://github.com/red-user23/wp-media-guard.git
  2. Activate the plugin in WordPress admin
  3. Configure settings at Settings → WP Media Guard

Configuration

Hotlink Protection Settings

Navigate to Settings → WP Media Guard and configure:

  • Enable Hotlink Protection: Toggle on/off
  • Allowed Domains: One domain per line (your site is automatically allowed)
    example.com
cdn.example.com
partner-site.com
  • Allow Empty Referer: Recommended for compatibility with some browsers/apps

Watermark & Blur Settings

  • Mode: Choose between Off, Watermark, or Blur
  • Watermark Opacity: 0-100 (default: 50)
  • Watermark Position: Bottom Right, Bottom Left, Top Right, Top Left, or Center
  • Blur Strength: 1-10 (default: 5)
  • Custom Watermark Path: Optional path to custom watermark PNG in uploads directory

Upload Logging Settings

  • Enable Upload Logging: Toggle on/off
  • Default Review Status for Images: Pending or Approved

Usage

Managing Review Queue

  1. Navigate to Media → Media Guard
  2. View all logged uploads with status
  3. Filter by status: All, Pending, Approved, Rejected
  4. Use bulk actions to approve/reject multiple items
  5. Quick actions available in the Media Library list view

Media Library Integration

The plugin adds a "Review Status" column to the Media Library with:

  • Visual status badges (color-coded)
  • Quick approve/reject links
  • Automatic status for non-image files

Using Custom Watermarks

  1. Upload your watermark PNG to the WordPress uploads directory
  2. Note the relative path (e.g., 2024/01/my-watermark.png)
  3. Enter the path in Settings → WP Media Guard under "Custom Watermark Path"
  4. The watermark will be automatically scaled to 20% of the thumbnail width

Checking System Information

Visit Settings → WP Media Guard and scroll to "System Information" to view:

  • Plugin version
  • WordPress version
  • PHP version
  • Imagick extension status
  • GD extension status

Technical Details

Architecture

The plugin uses modern PHP 8.0+ features with a clean, namespaced architecture:

wp-media-guard/
├── wp-media-guard.php          # Main plugin file
├── includes/
│   ├── Plugin.php              # Bootstrap class
│   ├── Admin/
│   │   ├── SettingsPage.php    # Settings interface
│   │   └── ReviewPage.php      # Review queue interface
│   └── Services/
│       ├── HotlinkProtection.php  # Hotlink logic
│       ├── WatermarkService.php   # Watermark/blur processing
│       └── UploadLogger.php       # Upload logging
└── assets/
    └── default-watermark.png    # Default watermark

Hooks & Filters

The plugin uses standard WordPress hooks:

  • template_redirect - Hotlink protection check
  • wp_generate_attachment_metadata - Apply watermark/blur to thumbnails
  • add_attachment - Log uploads
  • manage_media_columns - Add review status column
  • manage_media_custom_column - Display review status

Data Storage

All data is stored in WordPress post meta:

  • _wpmg_review_status - Review status (pending/approved/rejected)
  • _wpmg_upload_log - Upload log data (user, timestamp, filename, MIME type)

Security

The plugin implements WordPress security best practices:

  • Nonce verification for all state-changing actions
  • Capability checks (manage_options for settings, upload_files for review actions)
  • Input sanitization with sanitize_text_field(), sanitize_textarea_field()
  • Output escaping with esc_html(), esc_attr(), esc_url()
  • Direct access prevention
  • SQL injection prevention through WordPress APIs

Troubleshooting

Watermark/Blur Not Working

  1. Check Settings → WP Media Guard → System Information
  2. Ensure either Imagick or GD is installed
  3. If both are missing, contact your hosting provider
  4. Upload new images to test (existing thumbnails won't be retroactively processed)

Hotlink Protection Not Blocking

  1. Verify Enable Hotlink Protection is checked
  2. Ensure the external domain is NOT in your allowlist
  3. Check that "Allow Empty Referer" matches your needs
  4. Test with a direct link from another domain
  5. Some CDNs or caching plugins may bypass PHP-level protection

Review Status Not Showing

  1. Ensure Enable Upload Logging is checked in settings
  2. Existing media won't have status unless manually set
  3. Upload new media to test
  4. Check that you have upload_files capability

Performance Considerations

  • Hotlink protection runs on every image request from uploads directory
  • Watermark/blur processing happens once during initial upload
  • Original images are never modified
  • No database queries for hotlink checks (uses WordPress options)
  • Review queue limited to 100 most recent items (can be adjusted)

Frequently Asked Questions

Q: Will this watermark my existing images?
A: No, watermarks are only applied when WordPress generates thumbnails. Existing images remain unchanged. Re-generating thumbnails will apply watermarks.

Q: Can I remove watermarks later?
A: You can disable the feature, but existing watermarked thumbnails will remain. Use a plugin like "Regenerate Thumbnails" to recreate them without watermarks.

Q: Does this work with CDNs?
A: Hotlink protection works at the PHP level, so it may not work if your CDN serves images directly. Consider CDN-level protection for better performance.

Q: What happens if someone disables JavaScript?
A: All functionality works without JavaScript except bulk checkbox selection.

Changelog

0.1.0 (2026-01-19)

  • Initial release
  • Hotlink protection with configurable allowlist
  • Watermark/blur support with Imagick and GD
  • Upload logging and review workflow
  • Admin interfaces for settings and review queue

Support & Contributing

  • Documentation: README.MD
  • Issues: Report bugs via your repository's issue tracker
  • Security: See SECURITY.md for vulnerability reporting

License

This plugin is licensed under the GNU General Public License v2.0 or later.

See LICENSE for full license text.

Credits

Developed with ❤️ for the WordPress community.

Project Homepage: GitHub red-user23