What your WordPress uploads reveal: author names in PDF and Word files

Written with AI assistance and reviewed by Hexloom Labs.

If your site lets staff, clients or visitors upload files, the Media Library serves each one exactly as it was saved. Anyone who downloads it can read what the file carries.

What a downloaded file can reveal

• Word, Excel and PowerPoint keep document properties inside the file: the author, who last saved it, the company, and the revision count.
• PDFs keep an author, a creator program and a producer program, and often a copy of the same details in XMP.
• Photos can carry the camera model, the date and the GPS position.

None of it shows on the page. All of it is one download away.

Check a file before you upload it

• Office files: File > Info shows the author and last-modified-by. File > Info > Check for Issues > Inspect Document lists what can be removed.
• PDF: File > Properties in Acrobat or most readers shows Author, Creator and Producer.
• Photos: on Windows, right-click > Properties > Details. On a Mac, Preview > Tools > Show Inspector.

Menu names differ between versions, and these checks only show what the program chooses to show.

Cleaning by hand is the weak point

Word's Inspect Document and Acrobat's Sanitize Document both work. The problem is that every person who uploads has to remember, every time.

Doing it at upload time

We built a free plugin, Hexloom Upload Metadata Scrubber, that removes author and other identifying properties from Word, Excel, PowerPoint, PDF, JPEG, PNG and WebP files (company and revision details apply to Office files only) as they are uploaded. It shows a report of what it removed and what it found but could not remove. It runs on your own server and makes no outside requests.

It is not a guarantee. Names typed into the body of a document, tracked changes, comments, signed PDFs and password-protected files are not cleaned. PDF creation dates stay, and old .doc, .xls and .ppt files are skipped, so review any file that must be free of identifying data.

• Plugin directory: https://wordpress.org/plugins/hexloom-upload-metadata-scrubber/
• Longer guide and the full limits list: https://hexloomlabs.com/wp-upload-scrub/remove-author-from-uploads/?ref=devto-wpuploads

The free plugin handles new uploads only. A paid add-on for cleaning files already in the library is described on the same site.