Find images without detected references
Check common WordPress content, settings, page builders and WooCommerce data for image references. No scanner can detect every custom or hard-coded reference, so review findings before choosing what to clean.
DevDome Media Cleaner WordPress plugin
Clean up unused images with room to undo
DevDome Media Cleaner finds unused images, orphan images and missing media so you can review what needs attention. Move selected files to the Recycle Bin, check your site, then restore them or confirm permanent deletion.
Free and GPL licensed, reviewed by the WordPress.org plugin team.
On WordPress.org
Read from WordPress.org on
- Version
- 1.1.6
- Updated
- Requires WordPress
- 6.0 or newer
- Tested up to
- WordPress 7.1.3
- Requires PHP
- 7.4 or newer
- Licence
- GPLv2 or later
No account needed for scanning, cleanup and restore
Unlimited free scans and media review
6.0 minimum WordPress version
7.4 minimum PHP version
Review what is unused before removing it
Scan your Media Library and uploads folder, inspect cleanup reasons and review storage use. Selected files move to the Recycle Bin first, giving you time to check your website before permanent deletion.
Find orphan images in uploads
Scan the uploads folder for images without a matching Media Library record, including thumbnails left behind by deleted images. The disk scan covers images only; other file types are left alone.
Review reasons and storage use
Inspect unused images, orphan files and missing media in a grid or list. Search filenames, filter by status and sort by size, dimensions or age, then export scan results to CSV.
Recheck files before cleanup
Every selected file is checked again immediately before it moves. Recent uploads and uncertain files are not automatically selected, and review statuses show whether files are Safe to remove, Needs manual review or Protected.
Restore from the Recycle Bin
Move selected files to a local Recycle Bin and restore them to their original locations with one click. Apache and IIS protection rules are bundled; on nginx, add a deny rule yourself.
Back up media before cleaning
Create and download ZIP media backups before cleanup. Upload and restore backups when needed, with backup and restore jobs running on your server and continuing after you close the tab.
Scan in resumable background batches
Scans run in small background batches to reduce memory use and timeout risk. Pause and resume without starting over, or configure scheduled scans. Scheduled scans do not automatically delete media.
Track growth with optional Monitoring
Connect a free DevDome account and enable Monitoring to track media growth across connected sites and receive threshold alerts. It sends aggregate scan statistics, with no media files, filenames, image URLs or visitor data.
From your first scan to reviewed cleanup
Scanning and cleanup work without a DevDome account. Review the results, keep uncertain files for manual review and check your site while cleaned files can still be restored.
- 1
Install and start a scan
Install and activate DevDome Media Cleaner from WordPress.org. Open DevDome > Safe Media Cleaner and select Scan Media Library.
- 2
Review and move selected files
Inspect statuses, cleanup reasons and file sizes. Choose individual images or a bulk selection, then move selected files to the Recycle Bin.
- 3
Check your site before deleting
Check your website while files remain restorable. Restore anything you need to its original location, or confirm permanent deletion to reclaim disk space.
Frequently asked questions
Can it tell whether every image is unused?
No scanner can detect every custom or hard-coded reference. Unattached media can still be used on your site. The plugin checks common reference locations and rechecks selected files before moving them. Uncertain files need manual review and are not selected automatically. Check your site before permanent deletion.
Does it delete images automatically?
Not by default. Scheduled scans never delete media, and Auto-delete from Recycle Bin is a separate setting that is off by default; when you set it, files in the Recycle Bin are permanently removed after the number of days you choose. Nothing is removed until you review results and choose what to clean. Selected files move to the Recycle Bin first. Moving them there keeps them on disk; confirm permanent deletion after checking your site to reclaim that space.
Can I undo cleanup, and what happens if I uninstall?
You can restore files to their original locations with one click while they remain in the Recycle Bin. Restore or permanently delete every batch before uninstalling. Uninstalling removes the plugin tables, leaving the folder in place and making hidden attachments visible again. Files can no longer be restored from the plugin screen.
Does it clean orphan files and find duplicates?
The disk scan finds images in uploads without a matching Media Library record, including leftover thumbnails. Other file types are left alone. Identical copies among the unused images are grouped under Duplicates on the Review screen, with the oldest copy suggested as the original. A used image is never marked as a duplicate, and duplicates are never selected automatically.
Does it work with my page builder or WooCommerce?
It checks data used by Elementor, Divi, Beaver Builder, WPBakery, Bricks, Oxygen, Kadence, GenerateBlocks, Spectra, SeedProd and Thrive. It also checks WooCommerce product, gallery, variation and category images, plus ACF, Meta Box, Yoast SEO, Rank Math and AIOSEO data. Custom or hard-coded references can still be missed.
Will a scan keep running if I close the tab?
Yes. Scans, cleanups, backups and restores run on your server and continue after you close the tab. Reopen the plugin page to see progress. Scans use small, resumable background batches to reduce memory use and timeout risk. You can pause and resume without starting over.
Is it free, and do I need an account?
Scanning, review, reports, the Recycle Bin, restore, ZIP backups, scheduled scans, CSV export and WP-CLI commands are free and unlimited. No account is required for local media management. A free DevDome account is required only for optional Monitoring, which tracks media growth and sends alerts at your chosen threshold.
Does my media leave my server?
Scanning, cleanup, backups and restore run locally. Optional account connection sends connection details; Monitoring sends aggregate statistics, never media files, filenames, image URLs or visitor data. The plugin catalog fetch sends only the bundled core version. Pressing Report this error sends error and version details, screen, site address and admin email.
Documentation
Installation, settings, data use and troubleshooting, before you install.
Installing
Install DevDome Media Cleaner from WordPress.org through Plugins, Add New, search for DevDome Media Cleaner, or upload the ZIP, then activate it.
No DevDome account is needed to scan, review, report on, back up, remove, restore or permanently delete unused media. A free DevDome account is required only for optional DevDome Monitoring.
Setting it up
Open DevDome > Safe Media Cleaner in the admin menu and select Scan Media Library. Review the results and move selected files to the Recycle Bin. Check your site, then restore anything you need or confirm permanent deletion.
In Settings, configure scheduled scans, retention and protection rules. Scheduled scans do not automatically delete media. Recent uploads and uncertain files are not automatically selected for cleanup.
To track media-library growth across connected sites, connect a free DevDome account and enable optional Monitoring. Choose the unused-media alert threshold and email frequency.
On multisite, each site keeps its own scans, Recycle Bin, backups and settings. On WordPress 6.9 or newer, WordPress Abilities let AI agents and MCP clients (through the WordPress MCP Adapter) review results, run scans, clean up, restore files and manage settings under the same permissions; irreversible actions need an explicit confirmation.
What is sent outside your site
Scanning, classification, cleanup, backups and restores run on your own server. Recycle Bin files stay in /wp-content/uploads/devdome-safe-trash/. Bundled .htaccess rules for Apache and web.config rules for IIS protect that folder against public access; on nginx, add a deny rule yourself.
The DevDome plugin catalog request fetches names, descriptions, logos, links and WordPress.org slugs from https://devdome.com/wp-plugins/catalog.json at most once every 12 hours, and only after the site is connected to a DevDome account. Only the bundled core version is sent in this request, with no site or visitor data.
Optional DevDome account connection uses devdome.com in your browser, analytics.devdome.com for the start and claim handshake, and api.devdome.com to verify the connection. The Account ID, site domain and site token are transmitted. After approval, the plugin stores your public DevDome Account ID and site token, and the service returns the account email displayed in Settings. Disconnecting sends the site domain and site token once to unlink the site.
When you connect from the DevDome Tools dashboard using the Connect card that discloses this sharing, account checks also send the slug and version of each active DevDome plugin, the bundled DevDome library version, and WordPress and PHP versions. This lets your account show your sites and their DevDome plugins for support and update notices. These checks include nothing about other plugins, users, email addresses, content or visitors. Sites connected before this was introduced, or through a button without that disclosure, do not send the plugin list. Disconnecting stops the plugin list.
Optional DevDome Monitoring sends aggregate statistics to api.devdome.com after each scan only when enabled: site domain, site token, total media count and size, unused media count and size, orphaned file count, alert threshold, selected email frequency and the link to the plugin's wp-admin screen. DevDome stores this history, displays it in the media-health dashboard, tracks changes across scans and connected sites, and sends alert emails when the chosen threshold is exceeded. Account connection sends no media files, filenames, private image URLs or visitor data; Monitoring sends no media files, filenames, image URLs or visitor data.
Error reports go to https://devdome.com/api/plugin/error-report only when you press Report this error. They include the error text, plugin, WordPress and PHP versions, the screen you were on, your site address and your admin email so support can reply.
The bundled library references https://api.devdome.com/plugin-updates/ and https://api.devdome.com/media-cleaner/metrics, but both are disabled and are not contacted by the WordPress.org build. This build sends no product metrics. Beyond the catalog fetch and manually submitted error reports, no outbound request is made unless you explicitly connect a DevDome account. Monitoring statistics require you to also enable Monitoring.
How updates work
Installations and updates come from WordPress.org.
Uninstalling and your data
Restore or permanently delete every Recycle Bin batch before deleting the plugin. Uninstalling removes the plugin tables, leaves the Recycle Bin folder in place and makes hidden attachments visible again. Files left in that folder can no longer be restored from the plugin screen; uninstalling does not restore them to their original locations.
If something looks wrong
An unattached image can still be used on your site, and no scanner can detect every custom or hard-coded reference. Review each file's status and reason, keep uncertain files for manual review, and check your site before permanent deletion. Files marked Needs manual review are not selected automatically.
If cleanup affects your site, restore the cleaned files to their original locations while they remain in the Recycle Bin. Moving files there does not reclaim their disk space. Review the largest flagged files by sorting by file size, check your site, then confirm permanent deletion to reclaim that space.
Large scans run in small background batches to reduce memory use and timeout risk, and can be paused and resumed. Scans, cleanups, backups and restores continue on the server after you close the tab. Reopen the plugin page to see progress.
Unused images have a Media Library record but no detected reference on the site. Orphaned files have no matching Media Library record. The disk scan lists orphaned images in wp-content/uploads, including thumbnails left behind by deleted images, and leaves other file types alone. Identical copies among the unused images are grouped under Duplicates on the Review screen, with the oldest copy suggested as the original. A used image is never marked as a duplicate, and duplicates are never selected automatically.
Still stuck? Ask on the WordPress.org support forum or use the DevDome contact form. For a security problem, use the Report a security issue tab instead.
Read from the WordPress.org release when this site was last synced. The two latest versions are shown here; the full history is on WordPress.org.
Version 1.1.6
- A dismissible note at the top of the settings page mentions the free DevDome Analytics plugin, with a button that opens the plugin installer (or the Analytics screen when it is already active). Dismiss hides it for good.
- Shared DevDome library 1.7.13: uninstalling the last DevDome plugin also removes the note’s dismissal, the update-repair records and the per-user “Report a bug” flag; the visitor-beacon flood guard keeps one short-lived record per address and clears its expired ones itself, and behind Cloudflare it counts per visitor instead of per Cloudflare address.
- Deleting the plugin also removes its one-time migration marker and the cached update-check answer it kept in the database. The marker was loaded on every request after the plugin was gone.
Version 1.1.5
- Network uninstall now clears the shared DevDome connection state on every site of the network, not only the last one visited.
- Database guard: every action (the review screen, cleanups, restores, deletes, the admin page, the scheduled sweep, the Abilities API) now records a failed database query and refuses to write, move or delete anything after it. The screen says that a query failed instead of showing an empty library, an empty Recycle Bin or default settings, and a running job pauses with the error on it so you can resume it.
- State options (the cancel and rollback markers, the runner key, the site token) are read back after every write; a value that did not land is treated as not saved.
- Shared DevDome library 1.7.11: on a multisite network a site mapped to its own domain is its own site and no longer shares the network’s DevDome connection.
- Shared DevDome library 1.7.12: a Cloudflare visitor address header is trusted only when the connection itself comes from a Cloudflare address, so a forged header from anywhere else is ignored.
Found a security problem?
Please tell us before telling anyone else, and we will fix it and credit you if you want the credit. Use the contact form and say it is a security report, so it gets read first.
We are a small team, so we will not pretend to a 24/7 security desk or a guaranteed response time. We will read it, reply, and tell you honestly what we are doing about it.
Install from WordPress.org and review unused images
Install DevDome Media Cleaner from WordPress.org, open DevDome > Safe Media Cleaner and select Scan Media Library. No account is required.
More from the DevDome suite
All pluginsDevDome Analytics: Bot Traffic vs Human Traffic Website Statistics
Visitor tracking statistics: site stats, visitor stats, pageviews, sources, bot detection and outbound click reports. Free DevDome account required.
DevDome Bot Protection: Bot Blocker and AI Crawler Control
Detect scanners and unwanted bots, control AI crawler access and review caught requests in Record Bots before turning on blocking, without CAPTCHAs.
DevDome Malware Scanner - WordPress Malware Removal & Security Scanner
Scan for backdoor and webshell patterns. Review findings, quarantine files and repair eligible WordPress core and official plugin packages.
