Hexloom Upload Metadata Scrubber

When someone uploads a contract, price list or report to your Media Library, the file usually carries more than its content: the author’s name, the person who saved it last, the company, the software used, a revision count, and for photos the GPS position. Visitors can read all of it by downloading the file and opening its properties.

Upload Metadata Scrubber, from Hexloom Labs, removes that metadata from new uploads automatically and keeps a report for each file, so you can see what was removed and what the plugin could not remove. It works on your server: nothing is sent to any other service, and the plugin makes no external requests.

What it cleans

• Word, Excel and PowerPoint (.docx, .xlsx, .pptx and their macro and template variants): author, last modified by, revision number, last printed date, company, manager and custom document properties.
• PDF: author, creator, producer, title, subject, keywords and XMP details, where the structure of the file allows a safe change. The report lists what was found, and files that cannot be changed safely are left untouched and marked.
• JPEG, PNG and WebP images: EXIF (camera, date taken, GPS location), XMP and text chunks, removed without re-compressing the picture. Photo orientation and colour profiles are kept so images still look right.

What you see

Open any file in the Media Library and look for “Metadata scrub”: removed items, items found but not removed, and the reason. The Media Library list has a “Metadata” column with the same summary. By default the report records what kind of data was removed (for example “Author”), not the data itself, so personal details are not copied into your database. You can switch that on in the settings.

What it does not do (read this)

This plugin reduces the identifying metadata in uploads. It is not a guarantee that a file contains no identifying information.

• Only new uploads are processed. Files already in your Media Library are not touched.
• Names or details typed into the body of a document, tracked changes, comments, headers, footers or embedded images are not removed. Where the plugin can see them it says so in the report.
• Password-protected files, old .doc/.xls/.ppt files and unusual file structures are left untouched, and the report says why.
• PDF: the author, title and similar fields are blanked in place. Creation and modification dates and the document ID stay. PDFs that are digitally signed, or that store their document information in a compressed block, are reported but not changed.
• If cleaning a file could damage it, the plugin leaves the file as uploaded.
• Copies of the file kept elsewhere (email, backups, a CDN, other plugins) are not changed.
• It is not legal or compliance advice.

Requirements

PHP 7.4 or later. Word, Excel and PowerPoint cleaning needs the PHP Zip extension, which most hosts provide; if it is missing, those files are left untouched and the report says so.