AI-assisted draft by Hexloom Labs.

Five things to check in your WordPress Media Library before you publish a PDF or Word file

Files uploaded to the Media Library are served exactly as they arrived. WordPress resizes images but does not clean documents.

1. Open the file's properties. In Acrobat, File > Properties shows Author and Creator. In Word, File > Info shows Author and Last Modified By.
2. Check Word, Excel and PowerPoint files. They store the creator, the last editor and a revision count inside the file. Anyone who downloads the file can read them.
3. Check photos for GPS. Phone photos often carry the location where they were taken. WordPress keeps this data in the original upload.
4. Look at what is already in the library. Files uploaded last year are still downloadable. Search the library for .pdf and .docx and spot-check a few.
5. Decide who uploads. Authors, contributors and form plugins can all add files. A rule that runs on upload covers all of them.

A free option: Hexloom Upload Metadata Scrubber removes author, last-modified-by and revision data from PDF, Office and image uploads and shows per file what it removed and what it could not. Some PDFs (signed, password-protected) are only reported, not changed. It does not guarantee that all metadata is removed.
https://wordpress.org/plugins/hexloom-upload-metadata-scrubber/?ref=medialib

Guide with the limits: https://hexloomlabs.com/wp-upload-scrub/remove-author-from-uploads/?ref=medialib