Smush vs External Images Plugin

3.43 (3rd August 2026)

• Updated the shared Super Speedy settings module: AI agents can check your licence and install other Super Speedy plugins over MCP, now also exposed on AI Engine's MCP endpoint when AI Engine is active
• New Check frequency setting – cap licence, update and changelog checks to once a day or once a week, and see when the licence was last checked
• Licence and changelog checks fail fast when superspeedyplugins.com cannot be reached, instead of hanging the settings page
• The newest installed copy of the shared Super Speedy settings code now runs site-wide, whichever plugin loads first – previously the alphabetically-first plugin's often-older copy won
• AI agents can read and change External Images settings over MCP, count how products are imaged, and verify a sample of external image URLs – also exposed on AI Engine's MCP endpoint
• Fixed a fatal `array_key_exists(): Argument #2 ($array) must be of type array, false given` on PHP 8, hit on an HTTPS site when a product carried a malformed `http://` image URL such as `http:///photo.jpg` or one with a non-numeric port
• Malformed image URLs no longer raise PHP 8.1 deprecation notices when the proxy filename or the image host is read from them
• Security: the Per Website tab's HTTPS checkbox now requires a nonce and the `manage_options` capability, and only ever writes its own `eissl-` options
• Removed `ssl-proxy.php`, an unused legacy file that was still reachable over the web
• New Proxy HTTP Images setting, off by default. On an HTTPS site, an image whose host offers no HTTPS at all is blocked by browsers as mixed content. Switch this on to serve those images from your own server instead, at the cost of storing each one in `uploads/external-images/`
• Removed the "External Images DB update required" notice and its Run DB Update now button. The one statement behind it now runs by itself, once, with nothing to click
• Security: the variation gallery endpoint now checks that the id it is given is a published variation, instead of acting on any post id
• Removed the `EI_BETA` constant. It was defined but never read, so setting it did not opt a site into beta releases
• Tested up to WordPress 7.0
• Removed leftover debug logging. The plugin no longer writes to the browser console, including once per row per second on the WP All Import review screen
• The HTTPS support probe now times out after 3 seconds instead of stalling the page when a supplier host is unresponsive
• A supplier recorded as having no HTTPS is re-checked monthly, so a host that was briefly down is not proxied forever. Untick it on the Per Website tab to pin the choice and stop the re-check
• Pick largest now ignores an image whose size could not be read, rather than letting the failure decide which image wins
• Fixed a notice "Translation loading for the external-images domain was triggered too early" on WordPress 6.7 or later when the site language is not English, and the "Cannot modify header information – headers already sent" warnings it caused when activating the plugin
• Licence declarations in the plugin header and readme corrected to GPLv3