Janitorix Media Audit

Most cleanup plugins tell you an image is unused. This one tells you how sure it is, and why. That difference matters, because the cost of being wrong is not symmetric. Leaving an unused image costs you a few kilobytes. Deleting a used one breaks your site — and you may not find out for weeks. Read the full guide — why "unattached" is not the same as "unused", the places a reference hides, and how to check by hand · Development on GitHub — report issues or contribute. What it actually does Scanners search every place an image can hide: featured images and post attachments, post content, Gutenberg blocks and synced patterns, full-site-editing templates, the Customizer, theme options, widgets, menus, Elementor, ACF, WooCommerce, and your theme's PHP, CSS, and JavaScript files. Then two independent judgements are made about every image:

• Confidence — how sure we are the image is unused
• Risk — how much damage deleting it would cause if we are wrong

These are never blended into one score. A site logo nobody references and a stray upload nobody references look identical to a confidence score, and demand opposite actions. What it refuses to do

• It will not recommend deleting anything if it could not search enough of your site. Below 70% coverage, it says so and recommends a rescan instead.
• It will not offer Trash for anything at Medium risk or above, no matter how confident it is.
• It will never delete your site logo, icon, or header — those are refused outright, not merely scored low.
• It will not touch an image uploaded in the last 24 hours, because you probably have plans for it.
• It never deletes anything in one step. Trash first, always, and only from the Trash can anything be permanently removed.

Every number shows its work Open any image and you can see which scanner found what, how strong each piece of evidence was, and exactly why the plugin reached its conclusion. A confidence score you cannot inspect is a number you have no reason to trust. Honest about its limits A perfect scan reports 97%, not 100%. Proving an image is used takes one piece of evidence; proving it is unused means proving the absence of evidence everywhere — and "everywhere" is not somewhere you can finish visiting. Theme frameworks store images in ways nobody can fully predict, and page builders can assemble URLs at render time. The plugin reports the honest number rather than a comfortable one.

1.0.3

• Fixed: an image used only in a widget, the Customizer or a theme option could be judged unused.
• Fixed: trashing or restoring an image asked for a rescan that was not needed.
• Fixed: a scanned image was reported as never scanned once the site had changed.

1.0.2

• Fixed: scanner accuracy bugs in Gutenberg, Widget, Generic Fallback, and ACF scanners.
• Fixed: SafetyEngine now reads verdicts from the current scan only.
• Fixed: AttachmentResolver no longer resolves external URLs by basename fallback.
• Fixed: GenericFallbackScanner now reports database errors instead of swallowing them silently.
• Fixed: outside_uploads no longer flags bare filenames without path separators.
• Fixed: ScanFingerprint no longer recomputes per row on the Images screen.
• Fixed: ImageValueExtractor no longer reports non-image attachments as missing.
• Fixed: Plugin Check security and database query warnings.

1.0.1

• Fixed: the author link on the Plugins screen went to a WordPress.org profile page instead of the author's own site.
• Added: a link to the full guide in the plugin description.

1.0.0

• First stable release
• The Dashboard's Confidence card read 0% on every scan — the figure was calculated and displayed but never stored
• An image held back because it was uploaded recently now says how much longer it stays protected, instead of only that it is
• The Images list shows each image's upload date, which is also what the date filters above it match on
• Uninstall now removes the cached file hashes it wrote onto attachments, not only its tables, options and your saved decisions
• Risk Engine: a WooCommerce product's gallery images are now priced at their correct impact instead of the lower, generic rate a field-name collision was giving them
• Risk Engine: the site logo, icon, header, and background are held at the highest risk level whenever the Customizer Scanner cannot confirm them — previously this floor was documented but not enforced
• Risk Engine: a store's own placeholder image is now recognised and priced instead of going unnoticed
• Fixed a false "in use" reading on WooCommerce-imported images, caused by treating the import's own source-URL metadata as a usage reference
• ACF: a Relationship field configured to browse only the Media Library is now trusted as image evidence, the same as an Image or Gallery field
• Scan History lists only finished scans, and now shows the storage each one actually recovered
• Delete Permanently's confirmation is now enforced by the server, not only by the browser dialog
• A reminder to keep a recent backup, shown before a permanent delete
• The Images screen now labels a row it declines to offer for Trash as Protected, instead of leaving it blank

0.6.0

• The write path: Trash, Restore, and Permanent Delete, each gated by the Safety Engine
• A restore record is written before anything is touched, so recovery does not depend on WordPress having a media trash
• Bulk trash — every image still checked individually

0.5.0

• Calibration suite: seeded fixtures with known answers, run against the real pipeline
• A report of what would be deleted, having deleted nothing

0.4.0

• Dashboard, Images, Image Details, Scan History, Settings

0.3.0

• Risk Engine, Recommendation Engine, and the explanation layer

0.2.0

• Persistence, resumable batched scans, and fingerprint-based caching

0.1.0

• Scanner layer and Confidence Engine