About this plugin
ForgeDBI Media Organizer adds a workspace under Media → Media Organizer with three things WordPress’s own library does not have:
Folders that never move files. Nested folders, drag and drop, bulk moves, and folders inside WordPress’s own media picker. A folder is a label: moving a file between folders changes no URL and touches no file on disk.
Where used. A scan reads your content — the block and classic editors, featured images, galleries, site identity, core widgets, Elementor layouts and templates, and ACF image and gallery fields — and records every place each file is used, with a link to it. The scan says exactly what it checked and what it could not; “no references found” is reported as what it is, evidence from the sources read, never as proof a file is unused.
Cleanup you can take back. Instead of deleting, you quarantine: the file’s addresses stop working, the file and its record are held, and everything can be restored exactly as it was with one click. Nothing is ever deleted automatically.
Permanent deletion is a separate, explicit, Administrator-only step after a recovery window, with the filename typed to confirm. Protect any file or folder and it can never be quarantined or deleted, whatever a scan finds.
Also: exact duplicate detection by file contents, missing-file detection, smart views (saved filters, personal or shared), an activity log of every change and who made it, a Settings screen for the recovery window, scan sources and role permissions, and WP-CLI commands for all of it.
What it will not do
ForgeDBI Media Organizer never rewrites your content, merges or renames files, or deletes anything on its own. Those are deliberate. It reads; you decide.
Where quarantined files are kept
Quarantined files are moved into the plugin’s own folder in your uploads directory ( uploads/forgedbi-media-organizer/, wherever WordPress says uploads are), under a randomly named subfolder. Many web servers serve everything in uploads, so every file held there is encrypted (libsodium, or OpenSSL where libsodium is missing), and so is the record of where each belongs. The encryption key is kept in your database, never in that folder, so the files cannot be read even if someone finds and downloads them.
The folder also carries deny rules and an empty index for servers that honour them. If the server cannot encrypt, or the folder cannot be written, new quarantines are switched off and anything already held stays restorable.
Privacy
The plugin makes no request to any outside service. The only request it sends is from your site to itself, to check whether the web server would serve the quarantine folder (whose contents are encrypted either way). Nothing about your media leaves your server.
Source code and build
The admin interface in build/ is compiled from the TypeScript and React source shipped with the plugin in admin/src/. js 24, run npm ci, then npm run build. 0), bundled in vendor/.