External Image Importer - Import Remote Images to the Media Library
| 开发者 | nerdcow |
|---|---|
| 更新时间 | 2026年7月11日 20:02 |
| PHP版本: | 7.4 及以上 |
| WordPress版本: | 7.0 |
| 版权: | GPLv2 or later |
| 版权网址: | 版权信息 |
详情介绍:
- migrate to WordPress from another CMS;
- work across multiple environments, such as development, staging and production;
- paste external content drafts written elsewhere.
https://dev.example.com/..., so your production pages silently load images from staging. If the source environment is private, password-protected or taken down after launch, those images break.
This plugin fixes that automatically: it finds the external image URLs, pulls the files into your own Media Library, and updates the content so everything is served from your own domain.
Key features
- Safe imports. Every download is verified to be a genuine, decodable image of the expected type before any URL is rewritten. If a file fails that check - for example the "image" was really a geo-blocked placeholder page or an error document - it is discarded and your original reference is left unchanged, so a broken file is never put in place of a working URL.
- Self-hosted images. Serving images from your own domain means search engines index them on your domain and your pages no longer depend on a third party staying online.
- Full-size originals. It imports the full-size original and lets WordPress regenerate every registered size locally, then points the markup at the matching local size so the layout is unchanged.
- Duplicate-aware. Images that already exist in your Media Library (by source URL or exact filename) are reused instead of downloaded again.
- Zero configuration. It works on activation; there is nothing to set up.
- SSRF guard on every fetch. Before any download, the target URL is validated. Requests to private, reserved, loopback, link-local, ULA, CGNAT and IPv6 transition (6to4 / NAT64) ranges are blocked - including the cloud metadata endpoint
169.254.169.254. All resolved A/AAAA records must be public. - IP pinning and redirect re-validation. The validated public IP is pinned for the actual download (cURL transport), and redirects are followed manually with the SSRF guard re-run on every hop. A public, validator-passing URL therefore cannot be DNS-rebound or 30x-redirected to an internal address after the check.
- Scheme, port and credential locking. Only
httpandhttps, only ports80and443, and URLs containing embedded credentials (user:pass@) are refused. - Real content-type verification. After download the actual file type is checked, not just the extension. Anything that is not a genuine raster image is deleted and rejected.
- SVG and ICO are skipped by default. SVG can carry script and ICO is a common smuggling vector, so both are excluded.
- Download caps. A per-request timeout and a maximum file size are enforced (and filterable) so a hostile or runaway source cannot tie up or fill your server.
- Automatically on save. A single canonical save hook covers both the Block (Gutenberg) editor and the Classic editor, so newly pasted external images are imported the moment you save.
- It skips duplicates. Before downloading, it checks whether the image already exists in your Media Library - by the exact remote source URL it previously imported, and by exact filename against your whole Media Library (including images you uploaded normally). If a match exists it is reused instead of downloaded again.
- It imports the full-size original. Even when your content references a scaled image (for example
photo-1024x670.webp), the plugin fetches the full original and lets WordPress regenerate every registered size locally, then points the markup at the matching local size. - WP-CLI for retroactive fixes. Run
wp auei localiseto sweep content that was saved before the plugin was active, with--dry-run,--post_type,--post_idand--limitoptions.
src,data-srcanddata-lazy-srcattributessrcset(every candidate, with width and density descriptors)- Gutenberg block-comment JSON (
url/src/href) - CSS
background-image: url(...)in inline styles
- Block and Classic editors. A single save hook (
wp_insert_post_data) covers both. - Single sites and multisite. On multisite, each site's external images are imported into that site's own Media Library.
- Alt text and captions are preserved. The plugin only rewrites image URLs and remaps block attachment IDs; your alt text, captions and other attributes are left untouched.
- Supported formats: JPEG, PNG, GIF, WebP, AVIF and BMP. SVG and ICO are excluded by default for security.
- Actively maintained and tested against the current WordPress release.
安装:
- Upload the
nerdcow-external-image-importerfolder towp-content/plugins/, or install the plugin through the Plugins > Add New screen. - Activate the plugin through the Plugins screen in WordPress.
- That is it - no configuration is required. External images are imported automatically the next time you save a post or page.
- (Optional) To fix content saved before activation, run the WP-CLI command:
wp auei localise --dry-runto preview, thenwp auei localiseto apply.
常见问题:
Will it ever replace a working image with a broken one?
No - this is a core safety behaviour. Every download is verified to be a genuine, decodable image of the expected MIME type before any URL is rewritten. If the downloaded file is not a real image (for example a geo-blocked placeholder page or an error document), it is discarded and your original external URL is left exactly as it was. A broken local copy is never put in place of a URL that was working.
Does it work with the Block editor and the Classic editor?
Yes. A single save hook (wp_insert_post_data) covers both the Block (Gutenberg) editor - which saves via the REST API - and the Classic editor.
Does it work on multisite?
Yes. It runs per site, so each site's external images are imported into that site's own Media Library.
What happens to alt text and captions?
They are preserved. The plugin only rewrites image URLs and remaps the attachment ID stored in Gutenberg blocks; it does not touch your alt text, captions or any other attributes.
Which image formats are supported?
JPEG, PNG, GIF, WebP, AVIF and BMP. SVG and ICO are excluded by default for security (SVG can embed script, and ICO is a common smuggling vector). If you fully trust your sources you can extend the allowed set via the auei_allowed_extensions filter, but doing so is at your own risk.
Does it send my data anywhere?
No. The plugin uses no external services and contains no tracking or analytics. The only outbound HTTP requests it makes are to the image URLs that already exist in your own content, purely to download those images into your local Media Library.
Which image size does it import, and what happens to the block in the editor?
It imports the full-size original. WordPress content usually references a scaled image (for example photo-1024x670.webp); the plugin strips that -WxH suffix, fetches the full original, and lets WordPress regenerate every registered size locally - so you have the thumbnail, medium, large and full versions, just like a normal upload. The image in your content is then rewritten to the local copy at the same size it referenced, so the layout is unchanged. It also remaps the attachment ID stored in the block ("id":N / wp-image-N) to the new local attachment, so the editor's image controls keep working and no stale or colliding source ID is left behind. Both behaviours can be turned off with the auei_import_full_size and auei_remap_ids filters.
Will it re-download images it has already imported?
No. Before downloading, the plugin checks whether the image already exists in your Media Library and reuses it:
- by the exact remote source URL it previously imported (stored in
_auei_source_urlpost meta); and - by exact filename against your whole Media Library, including images you uploaded normally, not just ones this plugin imported.
auei_reuse_by_filename filter if you prefer always-fresh imports.
How do I keep images from a trusted CDN or partner as external?
Add the domain to the whitelist with the auei_whitelisted_domains filter. Whitelisted domains are never imported and their URLs are left untouched.
Is it safe to run on a server behind a private network?
Yes - that is a core design goal. The built-in SSRF guard blocks requests to private, reserved, loopback, link-local, ULA and CGNAT addresses, plus the cloud metadata endpoint, and requires every resolved IP of a host to be public before any fetch happens.
更新日志:
- Reuse existing Media Library images by exact filename - including images uploaded normally, not just ones this plugin imported - so copying a page whose images already exist on the destination no longer creates duplicate uploads. Matched on the exact stored-file basename, single unambiguous match only.
- Initial release.
- Automatic import of externally-hosted images on post save (Block and Classic editors).
- Imports the full-size original (regenerating every thumbnail and size locally) even when the content references a scaled "-WxH" image, then rewrites the markup to the matching local size so the layout is unchanged.
- Remaps the source-site attachment ID carried in Gutenberg image, cover and gallery blocks (
"id":N/wp-image-N) to the new local attachment ID, so blocks never point at a stale or colliding ID on the destination. - SSRF-safe URL validation: blocks private, reserved, loopback, link-local, ULA, CGNAT, IPv6 6to4/NAT64 and cloud-metadata addresses; requires all resolved IPs to be public; pins the validated IP for the fetch and re-validates every redirect hop; locks scheme, port and credentials.
- Real content-type verification after download; SVG and ICO excluded by default.
- Download timeout and maximum file-size caps (filterable).
- Attachment reuse by
_auei_source_urlmeta and (optionally) by previously-imported filename to avoid re-downloading. - URL rewriting across
src,data-src,data-lazy-src,srcset, Gutenberg block JSON and CSSbackground-image. wp auei localiseWP-CLI command with--dry-run,--post_type,--post_idand--limitoptions for retroactive fixes.- Comprehensive
auei_*filter set for whitelisting, allowed types, schemes and ports, caps and overrides.