=== Media Audit (by ROBOTSTXT) ===
Contributors: robotstxt, javiercasares
Tags: media, copyright, images, reverse image search, media library
Requires at least: 5.3
Tested up to: 7.1
Requires PHP: 8.0
Requires Plugins: action-scheduler
Stable tag: 1.8.3
Version: 1.8.3
License: GPL-3.0-or-later
License URI: https://www.gnu.org/licenses/gpl-3.0.txt

Audit your media library for copyright risks: track internal usage, run reverse image search via Google Vision, TinEye, and PicDefense, and classify results against configurable alert and ignored hostname lists.

== Description ==

Media Audit helps site owners and editors understand where their media files are used and whether those files appear elsewhere on the internet — a key signal for detecting potential copyright violations.

= Features =

* **Internal usage scan** — identifies every post, page, and custom post type that references each attachment as featured image, inline content, or post meta.
* **External reverse image search** — submits images to Google Cloud Vision (Web Detection) and TinEye Commercial API to find matching pages across the web.
* **Consensus detection** — surfaces domains independently confirmed by multiple providers, providing stronger copyright-risk signals.
* **Audit list** — filterable admin page showing each attachment's external scan status, alert classification, and top matching domains.
* **Alert management** — dedicated Alerts page to review active copyright-risk alerts and dismiss false positives with optional notes. Dismissed alerts are tracked separately and can be reactivated at any time.
* **WP-CLI support** — run or schedule scans from the command line.
* **GDPR compliance** — full WordPress privacy API integration for personal data export and erasure on request.
* **Async processing** — all scanning runs via Action Scheduler to avoid blocking web requests.

= Requirements =

* [Action Scheduler](https://actionscheduler.org/) plugin (declared as a required dependency).
* [Manager (by ROBOTSTXT)](https://www.robotstxt.software/plugins/robotstxt-manager/) plugin (recommended) — required to receive plugin updates.
* Google Cloud Vision API key (for Web Detection scanning).
* TinEye Commercial API key (for reverse image search).

== Using the plugin ==

= WP-CLI =

Install tables manually (normally handled on activation):

  wp mra install

Show current index and scan status:

  wp mra status

Run an internal usage scan (queues a batch):

  wp mra scan-internal [--batch=<n>]

Run an external reverse image search (queues a batch):

  wp mra scan-external [--batch=<n>]

= Extension hooks =

* `mra/internal/scanner/post_types` — filter the post types included in the internal usage scan.
* `mra/internal/scanner/meta_keys` — filter the meta keys inspected during the internal scan.
* `mra/external/providers` — register additional external scan providers.

== Installation ==

= Automatic download =

Visit the plugin section in your WordPress admin, search for "Media Audit"; download and install the plugin.

= Manual download =

Extract the contents of the ZIP and upload the folder to `/wp-content/plugins/robotstxt-mediaaudit/`. Once uploaded it will appear in your plugin list.

After activation, visit **Media Audit → Settings** to enter your API credentials.

== Frequently Asked Questions ==

= Do I need both Google Vision and TinEye keys? =

No. The plugin works with either provider configured. Results will only be collected from providers with a valid API key.

= Will scanning slow down my site? =

No. All scans are queued and processed asynchronously by Action Scheduler in small batches.

= What is consensus detection? =

When the same domain appears independently in both Google Vision and TinEye results for the same image, it is flagged as a consensus match — a stronger copyright-risk signal than a single-provider finding.

= Is data deleted when I uninstall? =

By default, no. Enable **Settings → Delete data on uninstall** if you want all plugin tables and options removed on uninstall.

== Compatibility ==

* WordPress: 5.3 - 7.1
* PHP: 8.0 - 8.5
* WP-CLI: 2.x
* Requires Plugins: action-scheduler

== Changelog ==

Only the 3 latest versions. The full changelog is at [www.robotstxt.software/plugins/robotstxt-mediaaudit/](https://www.robotstxt.software/plugins/robotstxt-mediaaudit/).

= 1.8.3 =

* Updates are now delivered through [Manager (by ROBOTSTXT)](https://www.robotstxt.software/plugins/robotstxt-manager/): the bundled self-updater (`robotstxt-updater.php`, `update.json`) was removed.
* The Plugins page now shows a dismissible notice when Manager is not installed and active, and the Settings page shows a permanent notice until it is.
* New `Update URI` header pointing to the plugin page at www.robotstxt.software; Plugin and Author URIs updated accordingly.

= 1.8.2 =

* Contribution guidelines restructured: `AGENTS.md` is now an index to topic-specific `AGENTS-*.md` files (single source of truth).
* Added `bin/preflight.sh` automated pre-deploy verification (PHPCS, PHPStan, PHPCompatibility, PHPUnit, composer audit, ZIP inspection).
* Added plugin header tests validating header consistency (`Stable tag` ↔ `Version` ↔ version constant).
* Added `.claude/settings.json` deny rules enforcing no-auto-deploy / no-push / no-tag / no-merge.
* Added `.claude/agents/security-auditor.md` and `.claude/commands/deploy-check.md` for clean-context pre-deploy audits.
* Fixed `bin/deploy.sh` excluding all `AGENTS-*.md` dev docs from the release ZIP (previously only `AGENTS.md`).

= 1.8.1 =

* Network Operations buttons now use standard HTML POST Forms with server-side redirect (PRG pattern), replacing the AJAX approach that failed due to network admin script-loading constraints.
* Removed unreliable in-render script enqueueing for Network Tools page; operation buttons now work without JavaScript.
* JS dismiss/cancel labels on the Alerts page now use i18n strings from `wp_localize_script`.

= Previous versions =

If you want to see the full changelog, visit [www.robotstxt.software/plugins/robotstxt-mediaaudit/](https://www.robotstxt.software/plugins/robotstxt-mediaaudit/).

== Compliance ==

This plugin adheres to the following security measures and review protocols for each version:

* [WordPress Plugin Handbook](https://developer.wordpress.org/plugins/)
* [WordPress Plugin Security](https://developer.wordpress.org/plugins/wordpress-org/plugin-security/)
* [WordPress APIs Security](https://developer.wordpress.org/apis/security/)
* [WordPress Coding Standards](https://github.com/WordPress/WordPress-Coding-Standards)
* [Plugin Check (PCP)](https://wordpress.org/plugins/plugin-check/)