Your WordPress uploads carry GPS and author data: strip it on upload

#wordpress #privacy #security #php

If you run a WordPress site and let anyone upload a photo or a Word file, check what the Media Library actually stores. WordPress keeps the file you upload as it arrived, and the original stays downloadable at its direct URL. Whatever the file carried goes public with it.

What a normal upload carries

Phone photos: EXIF with the camera model, the date and time taken, and often GPS coordinates. Open a photo's properties on a computer, or load it into any EXIF viewer, and the position is there.
Word, Excel and PowerPoint files: a docProps/core.xml and docProps/app.xml inside the zip holding the author, the person who saved it last, the company, a revision count and the last printed date.
PDFs: an Info dictionary and often XMP with author, creator, producer, title and keywords.

None of this shows on the page. It appears when someone downloads the file and opens its properties.

Do it by hand

For one file, an EXIF tool (exiftool -all= photo.jpg) or the Inspect properties dialog in Office works. The problem is the other uploads: the ones from colleagues, clients and guest authors, which nobody remembers to clean.

Do it on upload

I wrote a free plugin, Upload Metadata Scrubber by Hexloom Labs, that cleans new uploads in the Media Library as they arrive, on your own server:

JPEG, PNG and WebP: EXIF (including GPS), XMP and text chunks are removed without re-compressing the picture. Orientation and colour profile are kept.
.docx, .xlsx, .pptx: author, last modified by, revision number, last printed date, company, manager and custom properties.
PDF: author, creator, producer, title, subject, keywords and XMP where the structure allows a safe change.

Each file gets a short report in the Media Library showing what was removed and what was found but left alone. The plugin makes no external requests.

What it does not do

It is not a guarantee that a file is anonymous. It does not touch files already in your library (new uploads only), text typed into a document body, tracked changes, comments, headers or embedded images. Digitally signed PDFs are reported, not changed, so their signature stays valid. PDF creation and modification dates and the document ID stay. Copies kept in backups, email or a CDN are unchanged. It is not legal or compliance advice.

Plugin page: Hexloom Upload Metadata Scrubber

This article was written with AI assistance and reviewed before posting.