Sigma Media Manager

Fixed

• Divi Visual Builder: clicking a folder now filters the media grid, and the media list scrolls correctly.
• Media grid no longer runs under the Attachment Details panel, which could hide the last images.

Security

• Hardened uploads, folder-name output (stored XSS), cloud credentials/permissions, Document Library protection, AI/folder permission checks, update-check TLS, and download rate-limiting.

Added

• Folder sidebar now appears in the Divi Visual Builder media picker.

Fixed

• Deleting a media file no longer removes other images' original ("Restore original") backups.
• Moving a folder into itself or a subfolder is now rejected.

Improved

• Optimizer database upgrade runs once instead of on every request.

Security

• Document Library inline shortcode no longer exposes the whole media library — a [smm_document_library folder="..."] shortcode now serves only the folder it was published with, and requests without a folder are refused. Previously the endpoint behind the shortcode could be called directly to list every attachment on the site, including files that were never attached to a post.
• Password-protected libraries resist guessing — five wrong passwords lock further attempts for fifteen minutes, and a password can only be checked against the library it actually belongs to.
• Replacing an image verifies the file itself instead of trusting the file type reported by the browser.
• Licence responses are decoded with a strict type whitelist.
• The nonce endpoint no longer answers logged-out visitors.

Important

• Clear your page cache after updating. Pages cached before the update contain the old Document Library markup, and their file lists will stay empty until the cache is rebuilt.

Removed

• Removed the dashboard feed widget and related feed assets/code.

Added

• Folder sidebar for Posts, Pages and Plugins — the same folder tree now appears on Pages, Post and Plugin list screen.
• SVG upload — a Settings > General toggle (off by default) to allow SVG uploads.
• Sigma Gallery block — a Gutenberg block that displays images from your Sigma Media Manager folders in a responsive grid.
• Bulk-delete folders from the sidebar — Shift-click a range or Ctrl/Cmd-click individual folders to select several at once, then delete them together from a selection bar.
• Settings > General: Folder Sidebar Visibility section with Show Folder Sidebar in Pages, Posts, plugins toggles.
• Import from Folders (by Premio) — copy the Folders media folder tree and file assignments.
• Import from Wicked Folders — copy Wicked Folders media folder tree and file assignments.
• Import from Real Media Library — copy the Real Media Library media folder tree and file assignments.
• FileBird and WP Media Folder imports now include post and page folders, not just media folders — the full folder structure is copied across all three trees.

Improved

• All import prompts and Tools cards now report media, post/page folder, and assignment counts separately, and the import buttons unlock as soon as your Sigma folder list is empty.
• Import sources are checked in order and only one prompt is shown at a time; dismissing one offers the next.

Added

• Document Library: Access Control settings per library — choose Everyone (public), Logged-in users only, or Specific user roles only. Public remains the default, so existing libraries are unchanged
• Document Library: Allowed roles picker listing every role registered on the site, including custom roles added by membership plugins or code — new roles appear automatically with no update needed
• Document Library: Restricted access message field to customise the text shown on the page when a visitor cannot view a library; leave empty to use the default
• Document Library: restricted libraries serve every file through a protected download link, so direct wp-content/uploads URLs are no longer exposed in the page or the REST API

Updated

• System improved

Added

• Settings > General: Enable Media Manager toggle at the top of the tab to turn the Media Manager screen on or off (enabled by default). When disabled, the Media Manager link is hidden from the Media submenu and the screen is inaccessible.
• Settings > Cloud: per-provider CDN URL and Path Prefix in Advanced Settings — each object-storage provider (S3, Spaces, GCS, R2, S3-compatible, Bunny) keeps its own values when switching providers

Improved

• Settings: saving Enable Media Manager or Enable Document Library now updates the Media submenu in wp-admin immediately (show/hide links on hover) without reloading the page
• Settings > Cloud: Advanced Settings shown only for object-storage providers; hidden for Cloudinary and OAuth providers (Google Drive, OneDrive, pCloud) that use their own folder/subfolder settings
• Settings > Cloud: offloaded media URLs now use the URL saved at upload time, so changing CDN or path settings for one provider no longer breaks live links for files already on another provider
• Settings > Cloud: Test Connection result message is cleared when switching providers and only shown for the provider that was tested
• Settings > Optimization: Resize Options remain under Image Compression; large-image resizing works when compression is enabled without requiring Auto Compress on Upload

Fixed

• Bunny.net: fixed doubled path prefix in delivery URLs (404 on offloaded files when a path prefix was configured)
• Bunny.net: path prefix is applied on upload only; delete and file lookup use stored cloud paths correctly

Fixed

• Fixed slow product pages caused by repeated database lookups when rewriting image URLs to cloud storage
• Cloud offload status is now cached per page load (and via object cache when available), so each image is looked up once instead of many times
• Recommended for WooCommerce stores with large variable products or heavy image galleries

Improved

• Media library: toolbar Cloud Offload button now processes selected files in the same chunked batches as Settings bulk offload, preventing timeouts on large selections

Added

• Offload Media: Cloudinary provider (cloud name, API key/secret, optional upload folder, auto CDN delivery URLs)
• Offload Media: Custom S3-Compatible provider for MinIO, Wasabi, Backblaze B2, and other S3-compatible storage (custom endpoint, region, path-style addressing, and optional public URL base)
• Offload Media: Bunny.net Storage provider using Bunny Storage HTTP API (storage zone name/password, regional endpoint selection, and pull-zone delivery URL)
• Offload Media: cloud provider cards now use real brand icons/logos in settings UI

Improved

• White Label: when enabled, settings header Help & Support button and About Sigma Media Manager panel are hidden for client-facing branding

Fixed

• Settings > Cloud: interrupted bulk offload progress bar now reflects files processed instead of pages completed (fixes 0% when pausing mid-page)

Updated

• Settings > Cloud: bulk cloud offload processes the library in chunks with pause, resume, and discard-progress controls
• Settings > Cloud: bulk offload progress is saved in the browser session after each chunk so interrupted runs can be resumed without starting over

Fixed

• Media library: folder sidebar now appears in the Elementor image/media picker modal (same folder tree as Gutenberg and the block editor)
• Media library: media modal folder integration loads correctly in Elementor, which uses wp_enqueue_scripts instead of admin_enqueue_scripts
• Media library: improved media modal folder sidebar reliability with deferred wp.media initialization and DOM observation for late-loaded modals

Fixed

• Media library: modal dialogs (Delete Unused, Smart Organize, Bulk Generate, and Optimize) now render above the WordPress admin menu in Safari

Fixed

• Settings: REST API requests now use the correct path when WordPress is installed in a subdirectory (fixes save failures that returned a 404 HTML page from the main site)
• Settings: API client resolves REST URLs dynamically per request so cached admin pages do not send requests to the wrong host
• Settings: clearer error when the server returns a 404 HTML page instead of JSON

Added

• Media library: chunked usage-scan API for large sites (usage-scan/start, usage-scan/step, and paginated usage-scan/unused REST endpoints)
• Media library: cached attachment usage results (24 hours) with automatic invalidation when media is uploaded, deleted, trashed, restored, or post content changes
• Media library: automatic background usage-scan jobs rebuild the cache after content changes or when the 24-hour cache expires (WP-Cron)
• Settings > General > Background Jobs: toggle to enable or disable automatic Delete Unused background scans (manual scans still work when off)

Security

• Document Library: public API responses no longer expose direct download URLs for password-protected items; downloads are routed through the secure-download endpoint after verification
• Document Library: password hashes are removed from public library and folder REST responses (only has_password is returned)
• Document Library: added secure-download by attachment ID for folder-linked libraries so library-level password protection works without exposing direct file URLs
• OneDrive and pCloud: serve proxy endpoints now require a signed URL, a published parent post, or appropriate user capability—preventing unauthenticated bulk access by attachment ID

Fixed

• Media library: Delete Unused and Attached/Unattached filters no longer cause 504 Gateway Timeout errors on large media libraries
• Media library: usage scan runs in small batches per request with real progress in the Delete Unused modal instead of one long-running request
• Media library: improved usage-scan performance (bulk URL lookup, cursor-based database pagination, optimized URL matching)
• Media library: usage scan no longer stalls on WooCommerce and other meta-heavy sites—bootstrap is split into chunked numeric meta, gallery meta, and text-column steps with smaller postmeta batch sizes
• Media library: scan progress is persisted in the options table with a leaner session payload so large libraries do not lose scan state between batches
• Media library: generated CSS under uploads is scanned instead of walking the full theme directory tree during usage scans
• Media library: Delete Unused progress now shows the active step and batch number while scanning
• Media library: usage-scan step requests retry automatically with a short delay to reduce failures from security plugins and rate limiting (e.g. Wordfence)
• Media library: in-progress usage scans can resume instead of restarting from scratch when a session is still valid
• Media library: clearer API error when the server returns an HTML timeout page instead of JSON
• Media library: fixed plugin fatal error on load when registering usage-scan cache invalidation hooks
• Media library: Delete Unused Start Scan now reuses cached results instead of forcing a full rescan on every click
• Media library: Delete Unused shows a confirmation dialog before moving items to trash, with backup and scan-limitation warnings
• Media library: Delete Unused scan progress UI no longer shows a misleading step counter during cached loads
• Media library: fixed automatic background usage scans not being scheduled after post saves or when media was trashed or restored (cache was cleared but WP-Cron jobs were not queued)
• Settings: re-enabling Background Jobs now schedules the 24-hour cache refresh when a valid scan cache already exists
• Document Library: password-protected downloads now work after unlock—signed unlock tokens bridge the frontend and secure-download endpoint, and cloud-offloaded files are served when local copies are removed
• Document Library: Captcha providers reset after a failed unlock attempt so a fresh captcha is required instead of reusing an already-consumed token
• White label: settings sidebar license status badge is now hidden when Hide License Tab is enabled

Fixed

• Media library: Attached to posts and Unattached filters now work correctly inside folders and Cloud Offload (previously only applied on All Files)

Fixed

• Gemini AI text generation (captions, titles, alt text, and descriptions) now uses gemini-2.5-flash instead of the discontinued gemini-2.0-flash model
• Gemini API key validation in AI settings updated to test against the current supported model
• Delete Unused: media removed from Elementor pages is no longer blocked by stale Elementor cache meta (_elementor_element_cache, _elementor_css, _elementor_page_assets, and related keys)
• Delete Unused: Elementor usage is read only from _elementor_data and _elementor_page_settings; post revisions and _elementor_global_css are excluded from the scan
• Delete Unused: images referenced in CSS (background-image overlays, theme stylesheets, and generated builder CSS) are now detected as in use

Added

• Document Library Folder display layout on the frontend (sidebar folder tree, subfolder cards, and files below)
• Document Library folder layout: expandable nested folders in the sidebar with item counts and custom folder colors
• Document Library folder layout: grid and list toggle on the frontend for files (choice remembered per library for the session)
• Document Library folder layout: expanded folders stay open after a page refresh (saved in the browser per library)
• Document Library admin: Folder option in Display > Layout alongside Grid and List
• Google Drive as a cloud offload provider (connect with Google via OAuth in Cloud settings)
• Microsoft OneDrive as a cloud offload provider (connect with Microsoft via OAuth in Cloud settings)
• pCloud as a cloud offload provider (connect with your pCloud account via OAuth in Cloud settings)
• Optional upload subfolder for Google Drive, OneDrive, and pCloud: files go to sigma-media-manager or sigma-media-manager/your-name
• Plugin auto-creates the sigma-media-manager folder (and optional subfolder) on Google Drive, OneDrive, and pCloud when needed
• Timestamped file names on Google Drive, OneDrive, and pCloud so uploads do not overwrite existing files
• Public URL rewriting for offloaded Google Drive, OneDrive, and pCloud media, including thumbnail sizes when local copies are removed
• MTCaptcha as a Document Library captcha provider (alongside Google reCAPTCHA, Cloudflare Turnstile, and hCaptcha)
• Virtual file name rename in Attachment Details: change the display file name from the preview modal without renaming the file on disk or changing its URL (existing pages and embeds stay intact)
• Replace Image in Attachment Details (local files only): upload a new version without changing the attachment URL, so existing page embeds keep working
• Previous local files are archived under uploads/smm-backups/YYYY/MM/ as {attachment_id}_{filename}_(1), _(2), etc. on each replace

Updated

• Made compatible with WordPress version 7.0

Improved

• Cloud offload engine supports OAuth-based providers (Google Drive, OneDrive, pCloud) alongside S3, Spaces, GCS, and R2
• Deletion queue clears Google Drive, OneDrive, and pCloud attachment metadata when cloud objects are removed
• Bulk cloud offload statistics and dashboard counts are calculated more reliably
• Uninstall data removal (when enabled) also deletes white label options, Google Drive/OneDrive/pCloud OAuth transients, Appsbd license keys, and unschedules cloud/deletion cron hooks

Fixed

• Cloud upload backup paths and bulk offload summary counts now match actual offload results
• Image editor: Gemini AI edits no longer save excessively large files after transformation

Added

• White label (Agency, Extended, Developer, and eligible WL licenses): rebrand the Media Manager admin menus with a custom title, optional menu icon, and settings header logo
• White label options to hide the License tab in settings and to hide plugin admin menus for client delivery, with a signed recovery link emailed to the license holder (localhost shows a preview URL after save)
• Recovery token revoke control in white label settings

Added

• Document Library admin: drag-and-drop custom item order in grid and list (saved per folder; set Sort By to Custom Order on the library for the public view)
• Document Library display settings per library: optional title shortening with configurable character limit, and optional filename display under the title

Improved

• Document Library list view: name, type, size, date, and download columns now align correctly with their headers
• Multisite license admin: faster site list loading when choosing which subsites use the network license
• License status checks in the admin: browser-side caching with background refresh so license pages load faster between visits
• Media library toolbar: bulk action buttons (Duplicate, Download, Generate Text, Move to folder, Move to Trash, Optimize Media, and others) use solid colors instead of gradients
• Bulk rename / AI generate modal: AI Operation tab uses a solid color instead of a gradient when active
• Media library file sort moved to the main toolbar next to Bulk Select (hover submenus for ascending/descending, same options as before)
• Sidebar folder sort opens By Name, By Date, and Count directly on click (removed the extra Sort Folders step)
• Document Library admin grid reorder: drag any card to move it (no drag-handle icon on thumbnails)
• Media library and Document Library admin list views: Word documents (.doc, .docx, .odt, .rtf) show type as application/document instead of long vendor MIME strings
• List view Type column widened so MIME labels (e.g. application/document, application/pdf) display in full without ellipsis

Fixed

• Multisite network license caching: stale or repeated license validation no longer causes slow admin pages or incorrect active/inactive status after activation, deactivation, or changing licensed subsites
• License REST requests pinned to the current site URL so cached admin pages do not trigger cross-origin errors on multisite or alternate domains
• Document Library list view layout where type, size, and date stacked vertically instead of lining up under column headers
• Document Library settings save on existing sites when new display option columns are added to the database
• Document Library admin grid reorder not working on image thumbnails (browser native image drag blocked custom sorting)
• Document Library admin file-upload drop zone conflicting with drag-to-reorder in the same folder view

Improved

• PDF & EPUB cover thumbnails in the Document Library

Added

• Smart Organize now intelligently organizes media
• Media files used in posts/pages are organized into folders named after the post title
• Unused media continues to be organized by type (Images, Videos, Audio, Documents)
• "Duplicate file" action in media preview modal for quick single-item duplication
• "Duplicate" bulk action button in the media toolbar for selected items
• OpenRouter added as a new AI provider option in AI Settings
• Attachment alt text updates sync to posts and pages where that image is embedded
• AI metadata language setting in AI Settings
• FileBird & WP Media Folder migration: Import copies the folder hierarchy and media assignments
• EPUB (ebook) file upload support across Media Manager and Document Library
• Multisite license system for WordPress multisite (network-level license activation and management)
• Backup Files browser in Tools & Backup for reviewing and downloading local optimization restore files, cloud backup copies, and valid untracked files in uploads/smm-backups

Fixed

• Document attachments now show a simple "document" style label in file details for Word and similar office files (DOC, DOCX, ODT, RTF)
• File size no longer shows as zero when a file lives only in the cloud after you chose to delete the local copy
• Bulk Cloud Offload: the summary cards and successful count now match what really happened
• Bulk Cloud Offload: the remove-local-files option starts in sync with your Upload Settings choice
• Cloud offload totals on the dashboard are calculated more reliably so sizes and counts do not look empty or wrong

Added

• Cache exclusion filters for REST API endpoints to prevent caching interference

Fixed

• Folder visibility issue where folders created by one admin were not visible to other admins
• REST API responses being cached, preventing database operations from executing

Fixed

• Session expiration handling across all API calls — expired nonces now trigger an automatic page reload instead of showing a generic error
• Document Library frontend now properly detects and handles 401/403 authentication errors when fetching items or verifying captcha
• Document Library Admin folder fetching, item loading, folder creation, and item reordering now handle session expiration gracefully
• Media Library Folders (create, rename, delete, move) now detect session expiration and auto-refresh instead of showing unhelpful error messages
• Duplicate page refresh prevented by throttling auto-reload to once per 5 seconds using sessionStorage

Added

• Admin API notification system with countdown timers
• Multi-AI Provider Support: Now supports Free Credits, Gemini, OpenAI, and Claude AI providers
• Tab-based provider selection in AI Settings with individual API key configuration
• Real API key validation for all providers (Free Credits, Gemini, OpenAI GPT-4o, Claude 4 Sonnet)
• Provider-specific API integration for text generation
• Dynamic provider selection that applies to all AI text generation features
• Dashboard feed widget with styled RSS posts, banner image, badges, and footer links on the WordPress dashboard

Improved

• AI text generation now uses the selected provider from settings instead of only Gemini
• Provider-agnostic error messages throughout the application
• API key availability checks now work with any configured provider

Added

• Folder Download System

Fixed

• Right Click Context Portal
• Breadcrumb design issue

Added

• Cloud media offload feature with support for Amazon S3, DigitalOcean Spaces, Google Cloud Storage, and Cloudflare R2
• Automatic offloading of new uploads to cloud storage
• Bulk offload tool for existing media files
• URL rewriting to serve media from cloud storage
• CDN configuration support for faster media delivery
• Local file removal option to save disk space
• Cloud offload statistics dashboard
• Connection testing for cloud providers
• Path prefix configuration for organized cloud storage
• Restore functionality to download files back from cloud

Fixed

• Save Settings button in Cloud Storage tab now properly saves all cloud configuration settings
• Fatal error "Class Aws\S3\S3Client not found" by adding Composer autoloader for cloud storage dependencies
• Bulk cloud offload "Invalid parameter(s): folder_id" error by removing unnecessary folder_id parameter
• 502 Bad Gateway error when accessing media library by implementing proper lazy loading for cloud providers
• Cloud URL rewriter filter registration to prevent duplicate filter additions
• Database query error handling when cloud_offload table doesn't exist
• S3 upload error "The bucket does not allow ACLs" by removing default ACL parameter (compatible with modern S3 bucket policies)
• Media files now properly delete from cloud storage when deleted from WordPress (automatic cleanup)

Improved

• MAJOR PERFORMANCE BOOST: Bulk permanent delete is now 50-100x faster with background queue system
  • Immediate UI response (1-2 seconds) instead of waiting for cloud cleanup
  • Batch database queries replace sequential queries (O(1) vs O(n))
  • Background queue processes cloud deletions asynchronously
  • S3/R2/Spaces use native batch delete API (up to 1000 objects at once)
  • Automatic retry and error handling for failed deletions
  • Recurring cron job ensures no stuck items in queue
• Added "Cloud Offload" button to bulk selection toolbar for better UX (visible only when cloud storage is enabled)
• Added visual cloud icon badge on media items to easily identify files uploaded to cloud storage
• Cloud provider only initializes when cloud storage is enabled and actually needed (lazy loading)
• URL rewriting filters only register when cloud storage is enabled
• Comprehensive error logging and user-facing error messages for cloud offload operations
• Error messages now display specific reasons for offload failures (credentials, file not found, etc.)
• Console logging of detailed error information for debugging

Updated

• Delete unused functionality modal
• Media list view table data

Fixed

• Format conversion of AVIF format
• File restore with correctly formatted
• File delete with all the related optimized files
• Delete data on uninstall

Added

• Restore all optimized images back to their original state in advance

Added

• Annotation and drawing tools to Image Editor with Arrow, Line, Auto-numbered markers, Text, Brush, and Pen features
• Rectangle marking tool, click-to-select annotations, drag-to-move functionality, and keyboard shortcuts (Delete/Escape)
• Edit capability for text/number annotations, differentiate brush from pen behavior, integrate annotations into main undo/redo system
• Enhance color picker with checkmarks on selected colors and add 5 additional color options

Updated

• Refactor ImageEditor component into smaller modular files for better maintainability
• Improve annotation tool buttons UX with checkmark icons instead of color changes for active state

Fixed

• Save Image button to include annotations in the saved file
• Background scrolling is now enabled when any modal closes
• Items in the Trash folder no longer support drag-and-drop functionality

Added

• Image editor & edit image with AI prompt
• Image annotation and drawing tools (Arrow, Line, Rectangle, Auto-numbered markers, Text labels, Brush, Pen)
• Click-to-select and drag-to-move functionality for annotations
• Visual selection highlight with blue dashed border
• Keyboard shortcuts for annotations (Delete/Backspace to remove, Escape to deselect)
• Color picker and size controls for annotations
• Bulk rename options (Title, Caption & Description)
• Broken folders functionality option
• LocalStorage support for folder and file sortings
• Bulk selection of medias with keyboard shortcut

Fixed

• Better image optimization from settings
• Image resizer options
• Export & Import settings
• File informations issue
• API routing for editing image and generating texts
• Image preview modal design improve
• Folder & file drag and drop
• Medias drag & drop to trash folder
• Parent Folder drag & drop to its sub folder issue

Added

• Virtual folder system for media organization
• Drag and drop interface
• Bulk operations support
• Folder color customization
• Resizable sidebar
• Search and filter functionality
• WordPress media library integration
• Context menus for quick actions
• Upload to folder feature
• Modern React UI with Tailwind CSS