Upload Metadata Scrubber by Hexloom Labs

What Upload Metadata Scrubber cannot remove

The plugin reduces the identifying metadata in uploads and tells you what it found. This page lists what stays in a file, so you can decide whether that is enough for your site.

Not a guarantee. This plugin is not a promise that a file contains no identifying information, and it is not legal or compliance advice. If a file must be free of identifying data, review it yourself before it is published.

It only changes new uploads

Files already in your Media Library are not touched. Copies kept elsewhere (email, backups, a CDN, another plugin) are not changed either.

Word, Excel and PowerPoint

Removed: author, last saved by, title, subject, keywords, description, revision number, last printed date, total editing time, template, company, manager, hyperlink base, custom document properties and the preview thumbnail.

Not removed, and listed in the report when found:

  • Names, addresses and anything else typed into the body of the document.
  • Tracked changes and comments, which carry the names of reviewers.
  • Headers, footers and the reviewer list.
  • Embedded photos, which may carry their own EXIF data.
  • Local file paths inside links, and revision-save ids (rsid) in the document text.
  • Created and modified dates.

Left untouched: password-protected files, the older .doc, .xls and .ppt formats, and files with an unusual internal structure. The report gives the reason.

PDF

Removed: author, creator, producer, title, subject, keywords and XMP details, where the structure of the file allows a safe change. The fields are blanked in place.

Not removed: creation and modification dates, and the document ID.

Left untouched: PDFs with a digital signature, because any change would break the signature, and PDFs that keep their document information in a compressed block. They are marked “found, not removed” with the fields that were found. Password-protected PDFs are also left alone.

JPEG, PNG and WebP images

Removed: EXIF (camera, date taken, GPS location), XMP and text chunks, without re-compressing the picture.

Kept on purpose: photo orientation and colour profiles, so pictures still look right.

Text drawn into the picture itself, such as a visible watermark or a street sign, is the picture and is not changed.

When a file is left exactly as uploaded

The plugin writes a new copy, checks that it opens, and only then replaces the upload. If anything looks wrong, or the file is too large to process safely, the original stays as it was and the report says why. If the PHP Zip extension is missing on your host, Word, Excel and PowerPoint files are left untouched and the report says so.

What the plugin never does

  • It makes no requests to any outside service, and your files never leave your server.
  • It does not edit the text or layout of your documents.
  • It does not claim a file is clean. It lists what it removed and what it found and left.

Back to Upload Metadata Scrubber