As a lowly company employee working for a small-to-medium enterprise here in Tokyo, I spend a lot of my days staring at server logs and wondering why things are the way they are. You know the feeling—the grind of the day job, the endless meetings, and then coming home to tinker with WordPress because, well, that’s what we do.
Recently, I found myself wrestling with a problem that I’m sure many of you have hit. I was managing a site where users needed to upload files, but the security settings were keeping me up at night. The default WordPress media uploader is great, but it can be a bit too… trusting. I’ve always strongly resisted the idea of just letting any file through the gate, but configuring php.ini or messing with server-level restrictions isn't always an option, especially on shared hosting or when you’re handing the keys over to a client who isn't exactly tech-savvy.
So, in typical fashion, I decided to scratch my own itch. I took a script I’d originally written for my own testing and polished it up into a proper plugin. It’s called Media File Limiter, and I’m releasing it to the world (and to The Pro Panel) in hopes it saves someone else a headache.
The Problem: It’s Not Just About Size
We’ve all been there. You tell a client, “Please don't upload images larger than 2MB,” and five minutes later, they’re trying to push a 25MB raw photo from their DSLR directly into the Media Library. Or worse, you’re worried about security vulnerabilities—someone slipping in a .html or .js file that executes a script when opened.
Sure, you can set upload_max_filesize in PHP, but that’s a hard limit. Sometimes you want a softer, more flexible limit that you can change from the dashboard without restarting Apache or Nginx. And protecting against dangerous file extensions? That usually requires some htaccess wizardry that I frankly don't want to maintain forever.
My Solution: Catch It Early
The core idea behind Media File Limiter is simple: stop the bad stuff before WordPress even thinks about processing it.
I built the plugin around the wp_handle_upload_prefilter hook. For the developers reading this, you know that this hook fires very early in the upload process. Unlike validation that happens after the file is temporarily stored, this checks the file right at the door. If it doesn’t meet the criteria, it gets bounced immediately.
Here’s what it does right out of the box:
-
Limits Max Upload Size (MB): You can set a custom limit (say, 5MB) right in the settings. It doesn't override your server's hard limit (it can't miraculously increase your PHP limits), but it acts as a strict gatekeeper below that ceiling.
-
Blocks Dangerous Extensions: You can define a list of forbidden file types. I’ve set it to block the nasty ones by default—
.exe,.php,.html,.js. No more worrying about someone uploading a “profile picture” that’s actually a backdoor script.
Why I Built It
Honestly, I built it because I was tired of the anxiety. I wanted a “set it and forget it” solution that I could install on my p-fox.jp projects and know that the media library wasn't going to turn into a dumping ground for massive files or malware.
I’m just a guy in Japan trying to make WordPress a little safer, one commit at a time. It’s not a massive, enterprise-grade suite with a thousand bells and whistles. It’s just a sharp, focused tool that does one thing and does it well.
If you’re running a site where you need to keep a tight leash on what gets uploaded, give it a try. It’s available on the plugin repository now. And if you find a bug? Well, be gentle—I’m likely fixing it on my lunch break!
