Kodlo Media Manager

No. It validates configured formats, sizes, dimensions, filenames, duplicate names, and SVG content. It does not compress images, convert JPG or PNG files to WebP or AVIF, or remove unused media.

The initial profile encourages a WebP or AVIF workflow. It is only a starting point. Change the applicable rule to Allowed (Media Library Only) or Allowed (Globally) if your project uses JPG, JPEG, or PNG.

WordPress handles administrator-uploaded plugin and theme ZIP packages outside the Media Library. Allowing ZIP globally keeps those native installation workflows available, while WordPress's own capability and package validation still apply. Change the rule only if your site has a different package-upload policy and you have tested the affected administration screens.

Zero or a blank value disables the plugin's per-format size limit for that rule. WordPress, PHP, the web server, and the hosting provider may still impose their own limits.

Allowed (Media Library Only) requires a verified Media Library context. Allowed (Globally) also permits the configured format in other WordPress upload contexts. Blocked (Globally) rejects the format throughout WordPress upload handling.

It blocks exact normalized filename matches, not visually similar images or identical file contents with different names. Each distinct name is queried directly against Media Library attachment metadata. A short-lived hashed lock closes the race between lookup and storage for plugin-managed uploads. If WordPress cannot verify a name, the upload is stopped conservatively and can be retried.

No. Each filename is checked directly against existing _wp_attached_file metadata. The plugin does not rewrite attachment content, add attachment metadata, or maintain a custom filename table. Concurrent plugin-managed uploads use short-lived hashed option locks that do not contain the original filename.

Canonical .svg uploads are parsed locally with PHP's DOM extension. The sanitizer uses element and attribute allowlists, accepts only safe internal fragment references, and rejects document types, entities, external URLs, foreign namespaces, event handlers, and other unsupported active content. Files above the fixed parser ceiling are rejected before DOM parsing.

Yes. Patterns must be anchored and remain within the bounded subset that the plugin can evaluate consistently in PHP and JavaScript. Groups, alternation, backreferences, engine-specific escapes, excessive lengths, invalid quantifiers, and malformed expressions are rejected in favor of the default pattern.

When enabled for a compatible positive character-class pattern, the plugin mirrors the active WordPress locale's accent conversions in the media uploader, transliterates supported Cyrillic characters, chooses a separator that fits the pattern, normalizes letter case when practical, and removes unsupported characters. The server applies WordPress filename sanitization once and validates WordPress's final unique filename again before storage. Patterns with required literals, negated classes, or other constructs that cannot be generated deterministically remain validation-only and automatically disable rewriting.

When a rule defines width or height limits, the plugin verifies the uploaded raster image dimensions. For active rules, it also adjusts WordPress's big-image threshold to reflect the configured bounds while preserving a threshold that another component has explicitly disabled.

The plugin does not enqueue assets on public frontend pages. Upload validation runs only in relevant administrator or upload contexts. Duplicate Guard uses direct per-filename Media Library queries and deliberately rechecks an available name after locking and before movement, so its upload-time cost depends on upload volume, Media Library size, and database performance.