Home / Changelog
Every release of the WordPress alt text audit plugin, newest first, with the note published on WordPress.org.
Filikod 1.2.0 is the current version, released on 21 September 2026 and tested up to WordPress 7.1.1. This page mirrors the changelog of the plugin on WordPress.org: fixes, security changes and new detection rules, dated. Updates install from your WordPress dashboard like any other plugin, and every version stays free.
current version, released 21 September 2026
releases since December 2025
latest WordPress version tested
rating on WordPress.org, 5 reviews
Each entry is the note shipped with the release. Tags tell you at a glance whether a line adds something, fixes something or hardens security; version numbers are links you can share.
1.2.0 1.1.5 1.1.4 1.1.3 1.1.2 1.1.1 1.1.0 1.0.9 1.0.8 1.0.7 1.0.6 1.0.5 1.0.4 1.0.3 1.0.2 1.0.0
_filikod_file_hash post meta) and lists every group of exact copies uploaded more than once. Same layout as the ALT Audit: each copy shows its thumbnail, file name (with ID, dimensions, size and upload date), Context (where it is used), its ALT text, a Reference / Duplicate status (the reference being the oldest copy) and Edit / Library links. Groups are separated by a header line with the space that keeping a single copy would free. The scan controls sit at the top of the page. Fingerprints are computed automatically on upload and whenever the attachment metadata is regenerated (WordPress big-image scaling, Filikod resizer, image editor, Enable Media Replace, thumbnail regeneration), always from the original file when WordPress kept one, and back-filled for the existing library by a batched Scan library job (25 images per request, same engine as the other bulk jobs). Full rescan recomputes everything, for files replaced outside WordPress. Detection only: nothing is deleted or merged. Groups are cached for 15 minutes (filikod_duplicate_groups_v1) and invalidated on upload, deletion and fingerprint change. Perceptual near-duplicates (resized or re-encoded variants) are out of scope for this version.wp_prepare_attachment_for_js (filikod_duplicate_of), resolved from the cached groups (no extra query per thumbnail).wp.Uploader queue, so it works in the Media Library and in every editor media frame. Uploads are never blocked. New option filikod_duplicate_upload_alert (default yes), removed on uninstall.post_translations), WPML with Media Translation (post_attachment element type), Bogo (_original_post meta). Groups are recomputed when translation links change. Unlinked copies are listed with their language (FR, EN…) on the Duplicates page and in the attachment details. Weglot, GTranslate, TranslatePress, WPGlobus and MultilingualPress need nothing: they never create a second attachment for the same file on the same site.suppress_filters), matching the SQL counters used everywhere else in the plugin.icl_translations, post_translations, _original_post), so large libraries are not slowed down. Duplicate index bumped to filikod_alt_norm_counts_v3.image/* attachment by MIME type, so SVG logos (the most duplicated files on many sites) are detected. Attachments whose file is missing on disk are marked (x:missing) instead of being counted as “still waiting” forever; the scan block reports them and a Missing files tab lists them (expected path, context, ALT, links) so you can restore the file or delete the attachment; “Scan library” skips them and “Full rescan” retries them.filikod_alt_audit_v6, duplicate index to filikod_alt_norm_counts_v2.wp-admin/includes/media.php, ajax-actions.php, plugin.php, post.php, formatting.php, HTML API, REST comments, XML-RPC). The attachment finalize fix (#66056) and the media/AJAX changes do not alter the hooks Filikod relies on (attachment_fields_to_edit, attachment_fields_to_save, wp_prepare_attachment_for_js, add_attachment, wp_update_attachment_metadata, wp_check_filetype_and_ext). No incompatibility found._filikod_file_hash fingerprints (plugin cache, no editorial value) are removed on uninstall, on every site of a multisite network.Filikod_Duplicates (compute_hash(), hash_attachment(), get_hash(), identity_for_attachment(), get_groups_data(), get_summary()), new helper Filikod_Alt_Audit::counts_from_identity_map(), new helper Filikod_Media_Utils::count_images_with_title(). build_duplicate_map() and build_duplicate_map_with_alt_override() keep their signature and return type.add_attachment and delete_attachment, and as a safety net the audit table also skips any attachment that no longer exists when rendering the current page. Thanks to Patrick for the report.IMG_, DSC_, …) and slipped through as Alt: OK. Detection applies everywhere: ALT Audit tabs, Dashboard counters, and Media Library badges (list, grid, attachment details). The audit cache is bumped to filikod_alt_audit_v5 so the new rule applies on first load after update..ico uploads. WordPress performs a second MIME check against the real file content, and PHP detects .ico files as image/vnd.microsoft.icon (not the declared image/x-icon), so uploads were rejected “for security reasons” even with the option enabled. A dedicated wp_check_filetype_and_ext handler now accepts the real-world ICO MIME variants, including PNG-based favicons renamed to .ico.viewBox, gradients and clip paths. Element and attribute names were lowercased before being compared to a case-sensitive whitelist containing camelCase entries. As a result, viewBox, preserveAspectRatio, <linearGradient>, <radialGradient> and <clipPath> were removed from every sanitized SVG, breaking responsive scaling and visual rendering. Both sides of the comparison are now normalized, and gradient presentation attributes (offset, stop-color, stop-opacity, gradientUnits, gradientTransform, spreadMethod) are now whitelisted so preserved gradients actually render. The security posture (script/event-handler/external-reference removal) is unchanged.wp_handle_upload). Files brought in through sideloading (media_sideload_image(), the WordPress importer, third-party plugins) bypassed sanitization entirely. The wp_handle_sideload_prefilter and wp_handle_sideload hooks now run the exact same validation and sanitization chain.filikod-resized image size is now registered. It was hooked on after_setup_theme, which fires before the plugin’s classes are instantiated on init, so the registration never ran. The size announced for page builders (Elementor, Gutenberg) now actually exists.Filikod_Media_Utils class. No behavior change..svgz) could bypass the SVG sanitization chain, which only processes uncompressed .svg uploads. The SVGZ option has been removed from Settings > File types; sites that had it enabled will no longer accept .svgz uploads. Regular .svg uploads are unaffected and remain fully sanitized. If you previously uploaded .svgz files, we recommend reviewing them and re-uploading as standard .svg.Gemini_Generated_Image_* → e.g. “Gemini Generated Image i90nz7i90nz7”ChatGPT Image * → e.g. “ChatGPT Image Jul 7, 2024 at 02_30_00 PM”filikod_alt_audit_v4 so the new detection rule applies immediately on first load after update; previous v3 (and earlier) transients are explicitly cleared by invalidate_cache().filikod_media_size_stats_v1). The cache is auto-invalidated on attachment add/delete and after each automatic resize, removing repeated heavy queries on every Dashboard page load.filikod_save_alt now checks current_user_can( 'edit_post', $attachment_id ) per attachment, verifies that the target is an actual image (wp_attachment_is_image()), and truncates ALT text longer than 1000 characters before saving.<title>, <desc> and accessibility attributes (role, aria-label, aria-labelledby, aria-describedby, aria-hidden, tabindex, preserveAspectRatio). These elements are non-executable and required for WCAG-compliant inline SVG; the security posture against scripts, event handlers and external references is unchanged._transient_filikod_* and their timeouts) on every sub-site of a multisite network, preventing orphaned cache entries after plugin removal.error_log() calls in the SVG sanitization and image resizer paths are now gated behind WP_DEBUG, avoiding noise in production debug.log files.init; SVG security headers hook that never fired because static SVG files bypass template_redirect). No user-visible behavior change.title tooltip explaining the status and the recommended action (e.g. “ALT text exceeds 125 characters. Long ALTs are poorly read by screen readers and dilute SEO signals…”). Tooltips are translatable and parameterized with the actual character thresholds. A dotted underline (cursor: help) signals the tooltip on the Issue labelalt="" per WCAG). Decorative images are fully excluded from the ALT score (neither numerator nor denominator) so logos, dividers and purely visual icons stop dragging your score down. Dedicated Decorative column on the ALT Audit page with a toggle switch that auto-saves on change; dedicated Decorative tab to review and revert; dedicated Alt: Decorative badge in the Media Library#FFC736) and Alt: Too short in teal (#0DBB9C) for clearer visual differentiationfilikod_alt_audit_v3 (auto-rebuilt on first load); invalidation hooks now also listen to the new _filikod_decorative post metaToo long, Decorative, Marked as decorative., Image restored as a regular image, please add an ALT text., “too long” description with parameterized character threshold)Filikod_Alt_Audit::is_decorative(), Filikod_Alt_Audit::set_decorative(), new constants TOO_LONG_MIN_LEN, META_DECORATIVE, AUDIT_TRANSIENTcollect_alt_issue_codes() gains an optional fourth parameter $is_decorative defaulting to falseAlt: %s stringmedia-modal-alt-status.css enqueued after media-views (wp_enqueue_media) so the ALT Status label stays aligned with other field labels and with the badges, including under the 900px responsive rules_wp_attachment_image_alt changesfilikod_alt_audit_v2); normalized cache keys for object caches; attachment_fields_to_save ensures image_alt is persisted on save-attachment-compat like the classic uploader; invalidation hooks on post meta, attachment save, and related pathsfilikod_alt_norm_counts_v1); duplicate preview in the media modal avoids scanning every attachment per request; full audit rebuild reuses that indexrunFilikodBatchedJob)Updates are free and take one click from Dashboard › Updates. Not installed yet? Filikod scans your whole media library and scores your alt text in minutes.