NewThumbPress CDN — faster images worldwide.See how →
ThumbPress

Changelog

What's new in ThumbPress, release by release.

Latest version: 6.7.0.3 — last updated 2026-09-01 6:27am GMT

Version 6.7.0

September 1, 2026

  • [new] ThumbPress CDN (Pro): a new CDN screen and CDN settings tab. Serve your images from a global edge network — new uploads offloaded automatically, local copies optionally removed to free disk space, responsive srcset and WooCommerce product, variation and gallery images rewritten to CDN URLs, and an automatic fallback to your own server if the CDN is ever unreachable. The free plugin shows the screen and settings; offloading requires ThumbPress Pro
  • [perf] Regenerate Thumbnails now walks the media library by image ID instead of counting rows from the top on every batch, so a run no longer gets slower the further it goes — on large libraries the later batches are dramatically faster. Applies to both “Regenerate Now” and background regeneration
  • [fix] Regeneration batches are now ordered, so no image can be regenerated twice or skipped entirely because of the order the database happened to return rows in
  • [fix] Cancelling a background regeneration is now final — a batch that was already running could finish its images and write the progress counters back, leaving a cancelled run looking as though it had completed
  • [imp] Pro pricing now lists the CDN storage included with each plan

Version 6.6.0

August 26, 2026

  • [fix] Bulk WebP/AVIF conversion could delete your original images on servers whose image library cannot write WebP or AVIF — the “unsupported format” rollback removed the source file instead of the failed output, while the screen reported those images as merely “Failed”
  • [fix] Conversion now verifies the converted file before it replaces the original, so an empty or truncated output (disk full, interrupted write, broken GD/Imagick build) can no longer take the place of a working image
  • [fix] Regenerate Thumbnails no longer deletes the existing thumbnails before regenerating — a failed regeneration used to leave the image pointing at files that were already gone, with no way to repair it from the plugin
  • [fix] Regenerating an image whose original is not stored in the same format as its resized copy — an iPhone HEIC/HEIF upload, or any site converting uploads to another format — looked for a source file that never existed and failed; the true original is now used
  • [fix] The single-image “Regenerate Thumbnails” button reported “Thumbnails regenerated successfully” even when the regeneration had failed, and counted the removed thumbnails towards the Space Saved total
  • [fix] Fixed a fatal error that could take down the entire site — front end, admin and REST alike — on WordPress 6.0 to 6.7
  • [fix] Hotlink protection no longer breaks images whose filenames use non-Latin characters (Cyrillic, CJK, Bengali, Greek, Hebrew); they returned “not found” as soon as the feature was switched on
  • [fix] Background regeneration and bulk WebP conversion now restart themselves when a batch is killed by the server (timeout, memory limit, fatal error) instead of leaving the progress bar frozen with no error
  • [fix] Background regeneration now saves progress after each image, skips and reports an image that killed the previous batch, and finishes correctly when images are deleted while a run is in progress
  • [fix] Progress screens no longer freeze on sites behind aggressive caching — progress and action responses are now explicitly marked as non-cacheable
  • [perf] Lazy Load rewritten to use the browser’s own native lazy loading: no front-end JavaScript, images still render with JavaScript disabled, the first images stay eager so the largest-contentful-paint image is not delayed, and it now covers images from themes, page builders and custom fields that WordPress itself never lazy-loads
  • [fix] Lazy Load now steps aside for other lazy-loading plugins and honours the standard skip-lazy / no-lazy opt-out, instead of adding a second loading attribute to markup another plugin already rewrote
  • [imp] Turning Lazy Load on or off now clears known page caches automatically, so the change takes effect without a manual purge
  • [perf] The plugin no longer reads its own directories on every request to work out which controllers to load
  • [fix] Removed the broken “Turn on legacy mode” link from the General settings tab, along with the rest of the dead version-switching scaffolding left over from the old UI
  • [imp] Dashboard: the Unused Images card now says “no detected usage” instead of the confusing “Unattached”
  • [chore] Removed the upgrade routines kept for installs older than 6.3.3.1 — a site upgrading directly from before that release now starts from the default settings rather than carrying its old values across, and the Convert to WebP screen may show its progress counter reset once
  • [chore] The free plugin no longer shows its own “update ThumbPress Pro” notice on sites running Pro below 6.0; Pro shows its own warning instead
  • [chore] Codebase brought in line with WordPress Coding Standards, with a PHPCS ruleset added for contributors

Version 6.5.2

August 17, 2026

  • [fix] Fixed the image-hash backfill never finishing on large media libraries — images whose files could not be read were scanned again on every pass, so the background job restarted itself indefinitely and sent a constant stream of requests to admin-ajax.php. The backfill now works through images in order and stops when it reaches the end
  • [perf] The backfill is gentler on the server: larger batches spaced further apart mean far fewer background requests, and each batch now stops on a time limit so it is never cut off mid-run on slower hosting
  • [fix] Sites that stopped a runaway backfill by hand get one corrected pass automatically, so their images finish being hashed and duplicate detection sees the full library

Version 6.5.1

August 13, 2026

  • [compat] Version compatibility tested with 7.0.4
  • [fix] The Dashboard health score and Quick Facts now use your site’s language — these strings were previously always shown in English
  • [fix] Fixed the Convert to WebP “Images Processed” count being saved under a misspelled option key; existing progress is carried over automatically, so no counts are lost
  • [fix] Plugin option keys are now consistently prefixed with thumbpress_, avoiding clashes with other plugins; older keys are still read and migrated automatically
  • [fix] Fixed a PHP warning on admin screens that do not report a screen base
  • [chore] Removed unused internal scaffolding — the unreachable field-rendering framework, an unconditionally-true permission helper that was never wired to any endpoint, and other dead helpers. No change to plugin behaviour

Version 6.5

August 5, 2026

  • [new] New “Media Health at N%” notice in the admin bar, colour-coded by score and linking to the dashboard
  • [new] Convert to WebP and Regenerate Thumbnails progress now show a separate “Images Failed” count, so a genuine failure is no longer counted as a missing file
  • [new] Added Italian, Dutch, Russian, Japanese and Simplified Chinese translations
  • [security] Fixed a file-disclosure hole in the hotlink image proxy: it served files even when hotlink protection was off, and could be tricked into serving non-image files such as backups and logs
  • [security] Fixed hotlink protection being bypassable by omitting the Referer header
  • [security] Dismissing the “Pro not activated” notice now requires administrator privileges
  • [fix] Duplicate detection no longer misses duplicates when the image-hash backfill never finished — it now self-heals until every image is hashed
  • [fix] Convert to WebP now pre-checks the source formats saved in Settings instead of its built-in defaults
  • [fix] The AVIF source-format setting now saves and loads correctly

Version 6.4.1

July 21, 2026

  • [new] Added Spanish, German, French and Brazilian Portuguese translations, and refreshed Bengali
  • [new] Internationalized all admin strings and numbers so they can be translated
  • [perf] Faster WebP/AVIF conversion — database URL rewrites are now batched across the whole run
  • [fix] Fixed translations not loading for the current site locale

Version 6.4

July 16, 2026

  • [imp] Convert to WebP/AVIF: the single-image convert buttons now show the real reason a conversion failed instead of a generic “Failed to convert image” — including a memory-limit message stating how much memory was needed vs the server limit and how to raise it
  • [perf] Auto Featured Image: fixed an N+1 query on archive/blog/shop pages — the resolved image is now cached per request and persisted in post meta, so thumbnail-less posts no longer trigger a content regex scan and extra database query on every view
  • [perf] Dashboard: added stampede (dog-pile) protection to the large-image and thumbnail stat recompute so a cold cache under concurrent load recomputes once instead of many times
  • [perf] Dashboard: large-image count now uses a single indexed SQL query over stored file-size meta instead of a per-image filesystem scan, and the thumbnail count reads attachment metadata in chunks — the dashboard no longer risks timeouts or memory exhaustion on large media libraries
  • [imp] Header: pointed the community link to the ThumbPress community space and moved it first (before Support and Docs), with icons added to each link
  • [security] WP.org compliance: removed the remote Google Fonts request from the admin build and self-hosted Inter locally — no fonts are loaded from an external server

Version 6.3.3.2

July 14, 2026

  • [compat] Version compatibility tested with 7.0.1
  • [chore] Restructured the PHPUnit test suite

Version 6.3.3.1

June 28, 2026

  • [fix] WP.org compliance: removed legacy/ folder entirely — eliminates all legacy-specific violations (Google Fonts unconditional enqueue, cwebp binary files, 5-star review filter links, unguarded nonce checks, unescaped output in legacy views)
  • [fix] WP.org compliance: removed helpwp.dev in-plugin chat widget — the script was loaded automatically on every admin page without user opt-in (phoning home, Guideline 7); bundle rebuilt
  • [security] REST /option GET endpoint now enforces the same allowlist as the POST endpoint (thumbpress_allowed_option_keys filter) — previously any wp_option key could be read including sensitive WordPress core options
  • [fix] VersionManager simplified: get_version_to_load() always returns ‘new’; legacy routing, load_legacy(), register_rest_routes(), save_preference(), and dismiss_notice() removed
  • [fix] Admin/Init.php: inlined is_new_user() check directly (false === get_option(‘thumbpress_modules’)) to avoid call to removed VersionManager method

Version 6.3.3

June 27, 2026

  • [fix] WP.org compliance: removed Google Fonts enqueue (fonts.googleapis.com) from legacy admin — was loading unconditionally without opt-in consent (phoning home, Guidelines 7 & 9)
  • [fix] WP.org compliance: bumped rosell-dk/webp-convert from 2.9 to 2.9.5 in legacy/composer.json (out-of-date library)
  • [fix] WP.org compliance: documented the helpwp.dev in-plugin chat widget under == External Services == in readme.txt
  • [security] REST API permission callbacks now use current_user_can(‘manage_options’) (capability-based) instead of current_user_can(‘administrator’) (role-string) across all thumbpress/v1 endpoints
  • [security] All wp_verify_nonce() calls in legacy AJAX handlers now sanitize input with sanitize_text_field(wp_unslash()) before verification (8 locations across regenerate-thumbnails, convert-images, social-share, and AJAX classes)
  • [security] Fixed AJAX nonce bypass in legacy bulk WebP conversion (convert_images()): previously set an error message but continued executing file operations on nonce failure; now exits immediately with wp_send_json_error() + return, and added manage_options capability guard
  • [security] Fixed three AJAX handlers that accepted state-changing requests with no authentication: legacy image_sizes_dismiss() (now checks manage_options cap + nonce), AdminNotice::dismiss_pro_outdated_notice() (now checks manage_options + nonce), and legacy Notice::hide_notice() (now checks manage_options cap + sanitizes notice_id input)
  • [fix] WP.org compliance: replaced all bare _e() calls with esc_html_e(), esc_attr_e(), or echo wp_kses_post(__()) depending on context — 27+ locations in legacy views (modules.php, upgrade-pro.php) and controllers (Admin.php, Menu.php, disable-thumbnails, regenerate-thumbnails)
  • [fix] WP.org compliance: added defined(‘ABSPATH’) || exit direct-access guard to 12 PHP files that lacked it (legacy/app/Admin.php, legacy/app/Settings.php, six legacy module entry files, legacy/modules/disable-thumbnails/views/settings.php, legacy/modules/convert-images/inc/functions.php, app/Config/autoload.php, app/Helpers/functions.php)

Showing the 10 most recent releases. The full history is on the WordPress.org changelog.