Automatically import external and remote images into your Media Library on save and rewrite the URLs to local copies. Built SSRF-safe.

External Image Importer – Import Remote Images to the Media Library

External Image Importer automatically uploads externally-hosted images to your Media Library when you paste external content into the WordPress editor, then rewrites every URL to point at your own local copy. It is built SSRF-safe: every remote fetch is validated and hardened before the file is downloaded.
Remove the hassle of importing external images by hand when you:
<ul>
<li>migrate to WordPress from another CMS;</li>
<li>work across multiple environments, such as development, staging and production;</li>
<li>paste external content drafts written elsewhere.</li>
</ul>
<h4>The dev-to-live problem this solves</h4>
When you copy or migrate WordPress content between environments &#8211; for example from a dev or staging site to your live site &#8211; images embedded in that content stay hotlinked to the source domain. The block HTML (or pasted classic-editor markup) keeps pointing at <code>https://dev.example.com/...</code>, so your production pages silently load images from staging. If the source environment is private, password-protected or taken down after launch, those images break.
This plugin fixes that automatically: it finds the external image URLs, pulls the files into your own Media Library, and updates the content so everything is served from your own domain.
<h4>Key features</h4>
<ul>
<li>Safe imports. Every download is verified to be a genuine, decodable image of the expected type before any URL is rewritten. If a file fails that check &#8211; for example the &#8220;image&#8221; was really a geo-blocked placeholder page or an error document &#8211; it is discarded and your original reference is left unchanged, so a broken file is never put in place of a working URL.</li>
<li>Self-hosted images. Serving images from your own domain means search engines index them on your domain and your pages no longer depend on a third party staying online.</li>
<li>Full-size originals. It imports the full-size original and lets WordPress regenerate every registered size locally, then points the markup at the matching local size so the layout is unchanged.</li>
<li>Duplicate-aware. Images that already exist in your Media Library (by source URL or exact filename) are reused instead of downloaded again.</li>
<li>Zero configuration. It works on activation; there is nothing to set up.</li>
</ul>
<h4>Security</h4>
Server-side remote fetching is handled with defence in depth:
<ul>
<li>SSRF guard on every fetch. Before any download, the target URL is validated. Requests to private, reserved, loopback, link-local, ULA, CGNAT and IPv6 transition (6to4 / NAT64) ranges are blocked &#8211; including the cloud metadata endpoint <code>169.254.169.254</code>. All resolved A/AAAA records must be public.</li>
<li>IP pinning and redirect re-validation. The validated public IP is pinned for the actual download (cURL transport), and redirects are followed manually with the SSRF guard re-run on every hop. A public, validator-passing URL therefore cannot be DNS-rebound or 30x-redirected to an internal address after the check.</li>
<li>Scheme, port and credential locking. Only <code>http</code> and <code>https</code>, only ports <code>80</code> and <code>443</code>, and URLs containing embedded credentials (<code>user:pass@</code>) are refused.</li>
<li>Real content-type verification. After download the actual file type is checked, not just the extension. Anything that is not a genuine raster image is deleted and rejected.</li>
<li>SVG and ICO are skipped by default. SVG can carry script and ICO is a common smuggling vector, so both are excluded.</li>
<li>Download caps. A per-request timeout and a maximum file size are enforced (and filterable) so a hostile or runaway source cannot tie up or fill your server.</li>
</ul>
<h4>How it works</h4>
Paste your content as you normally would, then Publish or Save. When you do, the plugin scans the content for externally-hosted images, securely downloads each one into your Media Library, and rewrites the markup to your local copy at the same size it referenced, so your layout is unchanged.
<ul>
<li>Automatically on save. A single canonical save hook covers both the Block (Gutenberg) editor and the Classic editor, so newly pasted external images are imported the moment you save.</li>
<li>It skips duplicates. Before downloading, it checks whether the image already exists in your Media Library &#8211; by the exact remote source URL it previously imported, and by exact filename against your whole Media Library (including images you uploaded normally). If a match exists it is reused instead of downloaded again.</li>
<li>It imports the full-size original. Even when your content references a scaled image (for example <code>photo-1024x670.webp</code>), the plugin fetches the full original and lets WordPress regenerate every registered size locally, then points the markup at the matching local size.</li>
<li>WP-CLI for retroactive fixes. Run <code>wp auei localise</code> to sweep content that was saved before the plugin was active, with <code>--dry-run</code>, <code>--post_type</code>, <code>--post_id</code> and <code>--limit</code> options.</li>
</ul>
<h4>What it scans</h4>
<ul>
<li><code>src</code>, <code>data-src</code> and <code>data-lazy-src</code> attributes</li>
<li><code>srcset</code> (every candidate, with width and density descriptors)</li>
<li>Gutenberg block-comment JSON (<code>url</code> / <code>src</code> / <code>href</code>)</li>
<li>CSS <code>background-image: url(...)</code> in inline styles</li>
</ul>
<h4>Compatibility</h4>
<ul>
<li>Block and Classic editors. A single save hook (<code>wp_insert_post_data</code>) covers both.</li>
<li>Single sites and multisite. On multisite, each site&#8217;s external images are imported into that site&#8217;s own Media Library.</li>
<li>Alt text and captions are preserved. The plugin only rewrites image URLs and remaps block attachment IDs; your alt text, captions and other attributes are left untouched.</li>
<li>Supported formats: JPEG, PNG, GIF, WebP, AVIF and BMP. SVG and ICO are excluded by default for security.</li>
<li>Actively maintained and tested against the current WordPress release.</li>
</ul>
<h4>Privacy and external connections</h4>
This plugin does not phone home and does not send your data to any third party. There are no analytics, no tracking and no external API calls. The only outbound requests it makes are to the image URLs that already appear in your own content, purely to download those images into your Media Library. Nothing about your site, content or visitors is transmitted anywhere else.
<h3>Filters and Hooks</h3>
All filters use the <code>auei_</code> prefix.
<ul>
<li><code>auei_enabled</code> (bool, default <code>true</code>) &#8211; master on/off switch for the whole plugin.</li>
<li><code>auei_whitelisted_domains</code> (string[], default empty) &#8211; domains whose images are never imported (left as external), for example a trusted CDN.</li>
<li><code>auei_import_full_size</code> (bool, default <code>true</code>) &#8211; import the full-size original (strip a <code>-WxH</code> scaled suffix) so the destination regenerates every size. Set to false to import only the exact file referenced.</li>
<li><code>auei_remap_ids</code> (bool, default <code>true</code>) &#8211; rewrite the source-site attachment ID in Gutenberg blocks (<code>"id":N</code> / <code>wp-image-N</code>) to the new local attachment ID.</li>
<li><code>auei_allowed_extensions</code> (string[], default <code>jpg, jpeg, png, gif, webp, avif, bmp</code>) &#8211; image extensions eligible for import. <code>svg</code> and <code>ico</code> are excluded by default.</li>
<li><code>auei_allowed_schemes</code> (string[], default <code>http, https</code>) &#8211; URL schemes permitted for fetching.</li>
<li><code>auei_allowed_ports</code> (int[], default <code>80, 443</code>) &#8211; explicit ports permitted on a target URL.</li>
<li><code>auei_blocked_ip_ranges</code> (string[], default empty) &#8211; extra CIDR ranges to block, in addition to the built-in private/reserved set.</li>
<li><code>auei_max_file_size</code> (int, default <code>8388608</code>, i.e. 8 MB) &#8211; maximum download size in bytes; larger files are rejected.</li>
<li><code>auei_download_timeout</code> (int, default <code>20</code>) &#8211; download timeout in seconds.</li>
<li><code>auei_max_redirects</code> (int, default <code>3</code>) &#8211; maximum HTTP redirects to follow; every hop is re-validated by the SSRF guard.</li>
<li><code>auei_reuse_by_filename</code> (bool, default <code>true</code>) &#8211; reuse an existing Media Library image with the same filename (any attachment, not just ones this plugin imported) instead of downloading a duplicate. Matched on the exact stored-file basename.</li>
<li><code>auei_allow_url</code> (true or WP_Error, default validator result) &#8211; final override on a per-URL basis; return <code>true</code> to force-allow or a <code>WP_Error</code> to force-block.</li>
<li><code>auei_force_logging</code> (bool, default <code>false</code>) &#8211; force debug logging even when <code>WP_DEBUG</code> is off.</li>
</ul>

Alternative Plugins for

Discover the Lists with External Image Importer – Import Remote Images to the Media Library