Janitorix Media Audit
Janitorix Media Audit
Description
Most cleanup plugins tell you an image is unused. This one tells you how sure it is, and why.
That difference matters, because the cost of being wrong is not symmetric. Leaving an unused image costs you a few kilobytes. Deleting a used one breaks your site — and you may not find out for weeks.
Read the full guide — why “unattached” is not the same as “unused”, the places a reference hides, and how to check by hand · Plugin page · Development on GitHub — report issues or contribute.
What it actually does
Scanners search every place an image can hide: featured images and post attachments, post content, Gutenberg blocks and synced patterns, full-site-editing templates, the Customizer, theme options, widgets, menus, Elementor, ACF, WooCommerce, and your theme’s PHP, CSS, and JavaScript files.
Then two independent judgements are made about every image:
- Confidence — how sure we are the image is unused
- Risk — how much damage deleting it would cause if we are wrong
These are never blended into one score. A site logo nobody references and a stray upload nobody references look identical to a confidence score, and demand opposite actions.
What it refuses to do
- It will not recommend deleting anything if it could not search enough of your site. Below 70% coverage, it says so and recommends a rescan instead.
- It will not offer Trash for anything at Medium risk or above, no matter how confident it is.
- It will never delete your site logo, icon, or header — those are refused outright, not merely scored low.
- It will not touch an image uploaded in the last 24 hours, because you probably have plans for it.
- It never deletes anything in one step. Trash first, always, and only from the Trash can anything be permanently removed.
Every number shows its work
Open any image and you can see which scanner found what, how strong each piece of evidence was, and exactly why the plugin reached its conclusion. A confidence score you cannot inspect is a number you have no reason to trust.
Honest about its limits
A perfect scan reports 97%, not 100%. Proving an image is used takes one piece of evidence; proving it is unused means proving the absence of evidence everywhere — and “everywhere” is not somewhere you can finish visiting. Theme frameworks store images in ways nobody can fully predict, and page builders can assemble URLs at render time.
The plugin reports the honest number rather than a comfortable one.
Installation
- Upload the plugin through Plugins > Add New, or upload the ZIP via Plugins > Add New > Upload.
- Activate it through the Plugins menu.
- Open the new Janitorix menu in your WordPress admin sidebar.
- Click Start the first scan on the Dashboard. Nothing is deleted until you decide to act on a recommendation, and nothing is ever removed permanently without first going through the Trash.
Screenshots
The dashboard — a verdict first, with the reasons behind it
Every unused image with its confidence, its risk, and what to do about it. A row that cannot be trashed has no checkbox
Why an image scored what it did — where the plugin looked, what it found, and how the risk was reached
An image that is in use, with every reference that proves it, and the rule that refuses to trash it
The behaviour you cannot switch off, stated rather than offered
Every scan kept as a snapshot a later one never rewrites
Faq
That is the failure mode the entire design exists to prevent, and it is why coverage floors, risk ceilings, and never-delete rules all sit between a scan and any action. But no scanner can see a URL assembled at runtime, or an image embedded in a newsletter you sent last year. Trash first, and check before emptying it.
Elementor is supported directly. For builders that are not — Divi, Bricks, Oxygen — a fallback scanner sweeps for image references it does not understand. It will not raise your confidence score, because it cannot prove it searched thoroughly. It can and does prevent deletions.
Open the dashboard. If a scanner failed, it is named. If coverage is below 70%, it says so. The score is never lowered without a reason you can read.
No. Nothing is ever deleted without you clicking, and nothing is deleted in one step.
Every table and option the plugin created is removed. Your media is not touched.
The Media Library’s “Unattached” filter is not the answer — see below. Check post content, post meta (ACF fields, page builders, featured images), options (logo, Customizer, widgets), and theme files, by filename and by attachment ID. Or run a scan here: every image gets a confidence score with the evidence behind it.
Only after two conditions: the image is proven unused (not merely unattached), and deletion goes through Trash first so a mistake is reversible. This plugin enforces both — it refuses Trash for anything at Medium risk or above, and nothing is ever deleted in one step.
Every upload stays unless someone removes it, and WordPress generates several resized copies per upload. Unused originals plus their thumbnails accumulate silently. A periodic scan keeps it flat.
It can, in ways no database scan sees. An image can be unused on your site and still rank in Google Images or be hotlinked elsewhere — check Search Console, Performance, Images before a bulk delete. Deleted URLs return 404, which loses any signal they had; redirect if they mattered. Sitemaps list images too, and take time to regenerate. When in doubt, Trash and wait before emptying.
“Unattached” only means the image was not uploaded inside a post. It says nothing about whether anything references it — a logo, a Customizer image and most page-builder images are all “unattached” and all in use. Unused means no reference anywhere, which takes a real search to establish.
Reviews
Great Plugin for Media Cleanup
By 
Great plugin for keeping the WordPress Media Library clean and organized. Easy to use, safe, and very helpful for identifying unused media. Highly recommended!
Safe, Smart, and Transparent Media Cleanup
By 
Janitorix Media Audit is a fantastic and incredibly safe media cleanup plugin! Unlike other plugins that just guess, it provides clear confidence and risk scores, explaining exactly why an image is considered unused. It thoroughly scans everywhere (Elementor, ACF, theme files, etc.) and prioritizes site safety by never permanently deleting files in one step and protecting essential assets like logos. Highly recommended for anyone looking to clean up their WordPress media library without the fear of breaking their site!
Changelog
1.0.4
- New: SEO and social image keys (Yoast, Rank Math, SEOPress) are now read as declared image fields, so an og:image stored as a bare attachment ID keeps its image referenced.
- Fixed: CSV formula injection in exports.
- Fixed:
SHOW TABLES LIKEescaping, delete-permanent rescan, and coverage floor handling. - Changed: Plugin URI, Author URI, short description and Packagist metadata now point at the author’s site.
1.0.3
- Fixed: an image used only in a widget, the Customizer or a theme option could be judged unused.
- Fixed: trashing or restoring an image asked for a rescan that was not needed.
- Fixed: a scanned image was reported as never scanned once the site had changed.
1.0.2
- Fixed: scanner accuracy bugs in Gutenberg, Widget, Generic Fallback, and ACF scanners.
- Fixed: SafetyEngine now reads verdicts from the current scan only.
- Fixed: AttachmentResolver no longer resolves external URLs by basename fallback.
- Fixed: GenericFallbackScanner now reports database errors instead of swallowing them silently.
- Fixed: outside_uploads no longer flags bare filenames without path separators.
- Fixed: ScanFingerprint no longer recomputes per row on the Images screen.
- Fixed: ImageValueExtractor no longer reports non-image attachments as missing.
- Fixed: Plugin Check security and database query warnings.
1.0.1
- Fixed: the author link on the Plugins screen went to a WordPress.org profile page instead of the author’s own site.
- Added: a link to the full guide in the plugin description.
1.0.0
- First stable release
- The Dashboard’s Confidence card read 0% on every scan — the figure was calculated and displayed but never stored
- An image held back because it was uploaded recently now says how much longer it stays protected, instead of only that it is
- The Images list shows each image’s upload date, which is also what the date filters above it match on
- Uninstall now removes the cached file hashes it wrote onto attachments, not only its tables, options and your saved decisions
- Risk Engine: a WooCommerce product’s gallery images are now priced at their correct impact instead of the lower, generic rate a field-name collision was giving them
- Risk Engine: the site logo, icon, header, and background are held at the highest risk level whenever the Customizer Scanner cannot confirm them — previously this floor was documented but not enforced
- Risk Engine: a store’s own placeholder image is now recognised and priced instead of going unnoticed
- Fixed a false “in use” reading on WooCommerce-imported images, caused by treating the import’s own source-URL metadata as a usage reference
- ACF: a Relationship field configured to browse only the Media Library is now trusted as image evidence, the same as an Image or Gallery field
- Scan History lists only finished scans, and now shows the storage each one actually recovered
- Delete Permanently’s confirmation is now enforced by the server, not only by the browser dialog
- A reminder to keep a recent backup, shown before a permanent delete
- The Images screen now labels a row it declines to offer for Trash as Protected, instead of leaving it blank
0.6.0
- The write path: Trash, Restore, and Permanent Delete, each gated by the Safety Engine
- A restore record is written before anything is touched, so recovery does not depend on WordPress having a media trash
- Bulk trash — every image still checked individually
0.5.0
- Calibration suite: seeded fixtures with known answers, run against the real pipeline
- A report of what would be deleted, having deleted nothing
0.4.0
- Dashboard, Images, Image Details, Scan History, Settings
0.3.0
- Risk Engine, Recommendation Engine, and the explanation layer
0.2.0
- Persistence, resumable batched scans, and fingerprint-based caching
0.1.0
- Scanner layer and Confidence Engine