WP Manifestindependent plugin directory
manifest / developer / bedrock-file-proxy

Bedrock File Proxy WP Registry grade B. Medium-severity findings · 2 findingsWP RegistryMedium-severity findings · 2 findingsOpen the reportB

Mirror (or header to) uploaded files from a remote production Bedrock-flavored WordPress site or multisite on your local development copy.

★ 2stars
0.1.7latest · 2mo ago

Install

Download source zip No release zip yet

This is the repository archive. It installs, but the folder name will carry the branch suffix and updates will not flow.

Install straight from GitHub with WP-CLI:

wp plugin install https://github.com/utcweb/bedrock-file-proxy/archive/refs/heads/main.zip
No built-in updater. New versions won't appear under Dashboard → Updates. Install new releases yourself, or let Git Updater track the repository.

WordPress Bedrock File Proxy

Mirror (or header to) uploaded files from a remote production Bedrock-flavored WordPress site or multisite on your local development copy. Saves the trouble of downloading a giant uploads directory without sacrificing the images that accompany content.

Installation

  1. Add the following snippet above the "type": "composer" entry within the "repositories": section of your composer.json file:
{
  "type": "vcs",
  "url": "git@github.com:utcweb/bedrock-file-proxy.git"
},
  1. Install via composer using --dev so it only installs on non-production deployments:
composer require utcweb/bedrock-file-proxy:"*" --dev

No Composer Installation

  1. Clone this repository into your plugins/ directory.
  2. If using version control, delete the .git/ directory to prevent issues within parent Git history.

Setup

Bedrock File Proxy runs when WordPress is serving a 404 response for a request to the web/app/uploads or wp-uploads directory.

There are four options for this plugin, though only two are currently available via the UI. WP-CLI can be used to tweak the setting though, such as adjusting the mode to header.

wp option update bfp_mode header

Multisite configuration

For a Bedrock multisite installation, set bfp_url to the remote network's uploads root. Do not include a site's sites/{blog_id} directory in this value; that path is part of the requested file path and is appended automatically.

For example, to proxy uploads from https://blog.example.com in a local multisite environment:

wp plugin activate bedrock-file-proxy --url=https://local.example/
wp option update bfp_url https://blog.example.com/app/uploads/ --url=https://local.example/
wp option update bfp_mode download --url=https://local.example/

The plugin and options must be configured on the main site. Multisite upload URLs are network-rooted, so a request such as:

https://local.example/app/uploads/sites/9/2026/08/Expedition-unknown.png

is handled by the main site even when the image belongs to site 9 (/news/). With the configuration above, the proxy downloads the missing file from:

https://blog.example.com/app/uploads/sites/9/2026/08/Expedition-unknown.png

Available options

  • bfp_mode: The method used to retrieve the remote image. Default is header. One of:

    • download (downloads the remote file to your machine)
    • header (serves the remote file directly)
    • local (like download but serves an image from a directory in the current parent theme if the download fails)
    • photon (like header but uses arguments compatible with image resizing)
  • bfp_url: The absolute URL to the uploads directory on the source site.

  • bfp_local_dir: The name of the directory in the parent theme where images are stored for local mode.

Legacy compatibility

Older sfp_* option values and filter names are still read as fallbacks during migration.

Releases

3 releases.

Tag
Published
0.1.7 latest
Aug 21, 2026 2mo ago
Mar 24, 2026 7mo ago
Mar 20, 2026 7mo ago

These releases are tags only. The author does not attach a packaged zip, so there are no download counts to report.

B grade

Security

Bedrock File Proxy 0.1.6 · audited by WP Registry

Medium-severity findings.

1 medium 1 low
Audited release
0.1.6
Findings
2
Worst severity
medium
Content hash
b8e04ecc41ebd1d4644b3dae…

Findings

  • medium Path traversal in local upload write path (non-header modes)

    file_access

    bfp_get_relative_path strips only the uploads prefix from REQUEST_URI without rejecting .. segments. bfp_get_local_upload_path concatenates that relative path under WP_CONTENT_DIR/uploads. In fetch/write modes (not default header), bfp_dispatch file_put_contents the remote body to that path, enabling writes outside uploads if the webserver routes such URIs to WordPress.

    includes/image-processing.php:92-146,274-286,397-399

    Recommendation

    Resolve and realpath the destination; reject paths that escape the uploads root; sanitize relative path (no ..). Keep default header mode documented as the safe default.

  • low Plugin header version mismatches package tag

    version_mismatch

    Header Version is 0.1.6 while the audited package/tag is 0.1.7.

    bedrock-file-proxy.php:1-10

    Recommendation

    Bump header Version to match the release tag.

WP Registry hashes the installable build and reports on that exact bytes-for-bytes copy. Embargoed findings are withheld until they are disclosed, so a clean verdict means nothing public is outstanding. WP Manifest does not audit code itself.