Remove hidden metadata from photos
Photos taken on a phone usually carry the exact coordinates where they were taken, the device serial number and a timestamp. WordPress does not remove any of it on upload, so a published photo can quietly disclose a home address.
Common questions
Does WordPress strip EXIF automatically?
Not reliably. Since WordPress 7.1, photos uploaded in the block editor from Chrome or Edge are resized in the browser, and those copies drop their metadata. Uploads from Firefox or Safari, or through Media > Add New, are resized on the server, and on hosts that use Imagick every resized copy keeps the EXIF block, GPS included. Either way the original file stays on the server untouched, at a public URL, even when the media library shows a smaller "-scaled" copy. Strip the photo before it goes up.
What is actually in EXIF?
Typically GPS coordinates, the date and time, camera make, model and serial number, lens, and exposure settings. On phones the location is accurate to a few metres.
How does stripping work here?
The image is decoded to raw pixels and re-encoded from scratch. Metadata is not copied across because it never enters the canvas, so nothing is left behind to recover.
