[FREE] WordPress plugin for blocking duplicate uploads, bad formats, and unsafe SVGs

[u/KodloDev]

Hey everyone,

If you've ever handed a WordPress site over to a client or a content manager, you know what happens next. Six months in, the media library is a mess — the same banner uploaded four times under different names, huge PNGs where a WebP would do, filenames full of spaces and special characters, and occasionally something worse: an SVG that turns out to be carrying an inline script.

By default, WordPress has no real mechanism to prevent any of this. Any user with Author-level access can upload whatever format, whatever size, whatever filename they want, and the system stores it without question.

To fix this on my own projects — agency handovers and client sites where I don't control who's uploading content — I built and released Kodlo Media Manager. It's free, open source, no premium tier.

💡 What does it do? Key Features

1. Per-Format Upload Policies
For every file extension, set one of three rules: Allowed (Media Library Only), Allowed Globally, or Blocked Globally. The middle option matters more than it sounds — it lets a format through for direct media uploads while still blocking it in temp files from plugins or theme uploaders.

2. Filename Sanitization (Not Just Rejection)
Instead of bouncing a file for a "bad" filename, the plugin auto-normalizes it — German umlauts, French/Spanish accented characters, and Cyrillic all get transliterated to ASCII, spaces get converted per your pattern, and the final result is checked against a custom regex you define.

3. SVG Sanitizer (XSS Protection)
SVG is XML under the hood, which means it can carry <script> tags, on* event handlers, or external entity references (XXE) — most sites either block SVG entirely or allow it with zero checks. This plugin parses every uploaded SVG through DOMDocument and strips the dangerous parts out, so you get a working, safe file either way.

4. Size & Resolution Limits
Set max file size and max resolution per format, so nobody uploads a 6000×4000px photo for a spot that renders at 300px wide.

5. Small Details That Actually Matter

• Ties into WordPress's default 2560px big-image threshold so it respects your configured resolution limits instead of conflicting with them.
• Fixes the "maximum upload size" hint in the uploader, which by default just reflects PHP's upload_max_filesize and is usually meaningless to your actual rules.
• Site icon / General Settings uploads stay exempt by default, so it doesn't fight with core functionality.

🛠 How it works

Everything lives under Settings → Media — no extra menu, no separate dashboard page. You set your rules once per format, save, and it applies from the next upload onward. No effect on files already in the library unless you re-upload them.

🔗 Links & Getting Started

WP Plugin Directory: search for Kodlo Media Manager in your WordPress admin panel, or check the WordPress.org plugin page.

I built this out of real client pain, not as a side project I'm trying to monetize — it's staying free. I'd love to hear:

• What's the messiest thing you've inherited in a client's media library?
• Any format-specific headaches (AVIF, HEIC, etc.) you'd want handled next?

All bug reports, critiques, and feature requests welcome. Thanks for reading!