Upload Metadata Scrubber: Remove Author, PDF, Word and EXIF Metadata

When someone uploads a contract, price list or report to your Media Library, the file usually carries more than its content: the author’s name, the person who saved it last, the company, the software used, a revision count, and for photos the GPS position. Visitors can read all of it by downloading the file and opening its properties.

Hexloom Upload Metadata Scrubber, from Hexloom Labs, removes that metadata from new uploads automatically and keeps a report for each file, so you can see what was removed and what the plugin could not remove. It works on your server: nothing is sent to any other service, and the plugin makes no external requests.

What it cleans

• Word, Excel and PowerPoint (.docx, .xlsx, .pptx and their macro and template variants): author, last modified by, revision number, last printed date, company, manager and custom document properties.
• PDF: author, creator, producer, title, subject, keywords and XMP details, where the structure of the file allows a safe change. The report lists what was found, and files that cannot be changed safely are left untouched and marked.
• JPEG, PNG and WebP images: EXIF (camera, date taken, GPS location), XMP and text chunks, removed without re-compressing the picture. Photo orientation and colour profiles are kept so images still look right.

What you see

Open any file in the Media Library and look for “Metadata scrub”: removed items, items found but not removed, and the reason. The Media Library list has a “Metadata” column with the same summary. By default the report records what kind of data was removed (for example “Author”), not the data itself, so personal details are not copied into your database. You can switch that on in the settings.

What it does not do (read this)

This plugin reduces the identifying metadata in uploads. It is not a guarantee that a file contains no identifying information.

• Only new uploads are processed. Files already in your Media Library are not touched.
• Names or details typed into the body of a document, tracked changes, comments, headers, footers or embedded images are not removed. Where the plugin can see them it says so in the report.
• Password-protected files, old .doc/.xls/.ppt files and unusual file structures are left untouched, and the report says why.
• PDF: the author, title and similar fields are blanked in place; creation and modification dates and the document ID stay. In our tests, PDFs saved from Word, Windows Print to PDF, LibreOffice and Chrome were cleaned. Many PDFs saved by Adobe Acrobat or InDesign keep their document information in a compressed part of the file, and signed or password-protected PDFs cannot be changed safely: these are reported, not changed.
• If cleaning a file could damage it, the plugin leaves the file as uploaded.
• Copies of the file kept elsewhere (email, backups, a CDN, other plugins) are not changed.
• It is not legal or compliance advice.

Requirements

PHP 7.4 or later. Word, Excel and PowerPoint cleaning needs the PHP Zip extension, which most hosts provide; if it is missing, those files are left untouched and the report says so.

Optional Pro add-on (sold separately)

The plugin on this page is complete and free. A separate paid add-on, Hexloom Upload Metadata Scrubber Pro, is for sites that need more. It is sold on hexloomlabs.com, is not part of this plugin, and needs this plugin to be active.

• Clean the files already in your Media Library in bulk, not only new uploads.
• Export a CSV audit log of what was removed from each file.
• Cover uploads that come through WooCommerce and common form plugins.

$29 a year per site, plus tax where it applies. The licence key lasts 366 days and does not renew by itself. You can ask for a refund within 14 days of purchase if the add-on does not work as described. Details and checkout: https://hexloomlabs.com/wp-upload-scrub/?ref=wporg-readme