Changelog

This release is mostly about trust: files that were being listed as unused when they were still on your site, and warnings that were telling you the wrong thing.

Files that were in use, but listed as unused

• Fixed: your site logo could show as unused on almost every theme. Site logos, site icons, and any image set in the Customizer are now recognised.
• Fixed: on a block theme, images placed in a header, footer or page template through the Site Editor were never checked, so they could show as unused. Templates, template parts and reusable blocks are now included in every scan.
• Fixed: images in your widgets and in Additional CSS were not checked, and could show as unused.
• Fixed: a file could be wrongly held back from your unused list because of a mix-up with unrelated theme settings. Across five real sites this cut the number of files being guessed at from 79 to 2.

Safer deleting

• Added: deleting permanently now asks you to confirm, twice for a bulk delete and once for a single file. It asked nothing at all before, while moving files to Trash asked twice. Trash can be undone and permanent deletion cannot, so the warnings were the wrong way round.
• Added: moving files to Trash now asks you to confirm once, and tells you how many files.
• Fixed: Restore All on the Trash tab could say everything was restored while files were still sitting there. It now keeps going until the Trash is genuinely empty, and tells you if a file could not be restored.
• Fixed: whitelisting a file could quietly remove it from your unused list without actually adding it to the whitelist. This also affected restoring from the whitelist and the bulk versions of both.
• Fixed: the message confirming files had been moved to Trash did not always appear, and its link went to the Media Library rather than the Trash tab.

Clearer about what the free version can and cannot see

• Changed: when the plugin cannot read media held by another plugin, it now tells you how many files and which plugin holds them, instead of giving a vague warning. When there is nothing to report it stays quiet.
• Added: for Advanced Custom Fields and Secure Custom Fields, the plugin tells you how many media fields are set up on your site, so you know where to check before deleting.
• Changed: the dashboard now says plainly that the free version reads your posts and pages, and that media kept in a theme option, a plugin field or a store product is outside that scan.

The summary email

• Fixed: the email setting showed “Disabled” while the plugin was quietly sending it every three months. The setting and the behaviour now match, and the default is monthly.
• Fixed: pictures in the email were being sent at full size, so opening it could pull down tens of megabytes to show a row of thumbnails. It now uses the small version WordPress already made.

Finding your way around

• Changed: Media Hygiene now takes a single row in the WordPress menu instead of repeating the same four links in two places.
• Fixed: the “View Error Log” link in Settings did nothing. It is now the Scan Log, and it records what each page builder reader found during a scan.
• Changed: the “Download Media” button is now “Download Current Page Media”, because that is all it ever did.
• Fixed: the help popups on the Scan, Download and Trash buttons closed before you could click the link inside them.
• Fixed: after a scan finished, the page stayed scrolled below the results, so a scan that had worked did not look like it. It now returns to the top.

Also in this release

• Faster: large media libraries are noticeably quicker to check for new files.
• Faster: the plugin no longer adds weight to every page load of your site.
• Fixed: a scan could end on a blank page instead of a message, usually on a brand new install or after an interrupted scan.
• Added: the plugin can now be translated. It had no translation file before, so translators had nothing to work from.
• Tested with WordPress 7.1.3.

Compatibility

• Tested and confirmed compatible with WordPress 7.0.0.

Performance

• Scanning is significantly faster — especially on large media libraries. The scan engine now analyses page content directly instead of loading each URL over HTTP, which also means it works correctly on password-protected or staging environments.
• Database queries during scanning have been reduced by up to 30× per batch, resulting in lower server load and faster completion times.
• Memory usage during scanning is lower — large media libraries are far less likely to hit PHP memory limits.

Reliability

• If a single post or attachment causes an error during scanning, it is now skipped and the scan continues — the entire process no longer aborts because of one problematic item.
• All scan steps now show a clear, actionable error message if something goes wrong, including a plain-English explanation when a PHP timeout is the cause.
• Fixed: error messages from failed scan steps were not being displayed — users saw a generic fallback instead of the real reason.

Security & Housekeeping

• Several minor security hardening improvements to AJAX request handling.
• Deactivation feedback: your contact details are only submitted when you tick the share-contact checkbox.

• Security: Hardened all database queries against SQL injection throughout the plugin.
• Security: Improved plugin shutdown handling to correctly respect WordPress hooks.
• Security: Sensitive server error details are no longer shown to users in the browser.
• Security: Fixed a potential XSS issue in the media URL copy action.
• Privacy: Added an explicit opt-in notice for anonymous usage data collection — data is only sent if you choose to allow it.
• Privacy: The deactivation feedback form now includes an opt-in checkbox before sharing your name, email, and site URL.
• Bug fix: Dashboard stats (Total Media, In Use, Left Over) now always show correct values.
• Bug fix: The “Unused” tab count now updates correctly when a category or date filter is active.
• Bug fix: “Download Media” now downloads only the filtered files when a filter is applied.
• Bug fix: “Trash Current Page Media” now trashes only the filtered files when a filter is applied.
• Bug fix: Fixed PHP notices that could appear in certain page contexts.
• Bug fix: Fixed a display issue with the last-scan timestamp.
• Performance: Improved memory usage during scan on large sites.
• Performance: Improved memory usage when creating ZIP downloads.
• Compatibility: Minimum PHP version updated to 8.0.

• Security: Fixed missing authorization — all AJAX and admin-post handlers now properly terminate with HTTP 403 instead of silently returning (resolves CVE-2025-49979, CVE-2025-47469, CVE-2024-5855)
• Security: Fixed SQL injection risk in whitelist, blacklist, and bulk action handlers — all queries now use `$wpdb->prepare()` with typed placeholders
• Security: Fixed SQL injection in save-scan-content helper and Elementor data query — switched from string concatenation to `$wpdb->prepare()`
• Security: Fixed SQL injection in download handler — LIMIT/OFFSET values cast to int and passed through `$wpdb->prepare()`; IN() clause values sanitized via `intval()`
• Security: Fixed unescaped output in nonce failure handlers — replaced bare `die(__())` with `wp_die(esc_html__(), ”, array(‘response’ => 403))`
• Security: Fixed potential email header injection in cron notification — recipient addresses now validated with `is_email()` before sending
• Security: Fixed unescaped URLs in cron notification email — attachment URLs now wrapped in `esc_url()`
• Fix: Corrected `MH_FILE_VERSION` constant to match plugin version for correct asset cache-busting

• Security Release

• Improved – Revamped the scanning process for Elementor to improve accuracy and efficiency.
• New – Added a trash functionality feature, allowing users to easily delete and restore items as needed.
• New – Move Menu Position on desired location in WordPress Backend.

• Security Release

• New – Allow to set number of results shown per page (use with caution, large number can cause website to crash due to limitations of WordPress and hosting environment)
• New – Get email notifications for uploaded media files (weekly, biweekly, daily, monthly, quaterly) that have not been scanned
• Improved – Recognize background image scanning when using background-url tag

• Improved –  UI/UX for readability and access
• Improved – Better performance
• Updated – Compatible with PHP 8.1
• Updated – Error log handling
• Updated – Data privacy
• Added – File exclusion for CSS created by plugins
• Added – FAQ’s Tab in header
• Added – Compatibile with Litespeed Cache Plugin
• Bug Fix – Settings page loading issue
• Bug Fix – Scan stuck issue

• Better image detection in source code
• Support for WP Engine server options
• Feedback upon deactivation
• UI/UX improvement in admin dashboard

• Performance & Combability Improvement

• Performance Improvement

• Compatibility with Astra and Ocean WP theme

• Improvements with Enfold theme
• Better notice for scanning themes and plugins

• Initial Release