WordPress Performance Analyzer
A Core Web Vitals audit plus an AI-generated action plan — enter your URL and see exactly what's slowing your site down.
Google's Core Web Vitals — Largest Contentful Paint, Interaction to Next Paint, and Cumulative Layout Shift — directly affect both user experience and search ranking, but the standard PageSpeed report gives you a wall of technical metrics without a clear "do this next" answer specific to your WordPress setup.
This tool runs a real PageSpeed analysis against your live URL, detects your WordPress version and active theme, then feeds those findings to an AI model that generates a prioritized, WordPress-specific action plan — not generic advice, but recommendations grounded in what your site is actually running and what its real scores show.
Example: A site with a heavy homepage
Input: https://example.com
performance_score: 61/100
core_web_vitals:
LCP: 3.8s (needs improvement)
CLS: 0.02 (good)
INP: 210ms (good)
ai_recommendations (top 3):
1. Compress and lazy-load the 6 uncompressed hero images (est. 1.2s LCP improvement)
2. Defer 3 render-blocking plugin scripts not needed above the fold
3. Enable a page caching plugin — no caching layer currently detectedBest Practices
A homepage often has different performance characteristics (more images, more widgets) than a typical blog post or product page — checking both gives a fuller picture.
Performance issues can compound — fixing one bottleneck sometimes reveals a second one that was previously hidden. Re-run the analysis after each significant change rather than trying to fix everything from one report.
Page load performance varies run to run depending on server load and network conditions — a single score is a real data point, not a guaranteed number every visitor will experience identically.
Frequently Asked Questions
This tool runs the same underlying PageSpeed analysis, but adds WordPress-specific context (detected version, theme, and plugin footprint) and turns the raw metrics into a prioritized, AI-generated action plan rather than a long list of generic audits.
Desktop strategy is used for the underlying PageSpeed analysis — a real limitation worth knowing if your traffic is predominantly mobile, where scores are often meaningfully different.
It can often identify render-blocking scripts and other detectable bottlenecks from the page's actual resource loading, but attributing every issue to a specific plugin isn't always possible from an external scan alone.
Yes — the analysis fetches your URL directly, the same way Google's own PageSpeed tool does, so password-protected staging sites or local-only environments can't be analyzed.
Plugin Conflict Detector
Scan your live site's detectable plugins for known conflict pairs and get AI-suggested alternatives before something breaks.
Some of the most frustrating WordPress bugs aren't caused by a single broken plugin — they're caused by two otherwise-fine plugins that don't play well together: two SEO plugins both trying to manage sitemaps, two caching plugins fighting over the same hooks, two page builders injecting conflicting CSS. These conflicts are rarely documented anywhere obvious, and diagnosing them usually means deactivating plugins one by one until the problem disappears.
This tool scans your site's publicly detectable plugin footprint (via page markup — it can't see server-side-only plugins that leave no front-end trace), checks the detected combination against known conflict patterns, and uses AI to assess overall risk and suggest alternatives where a real conflict is found.
Example: Two competing SEO plugins detected
Input: https://example.com, both Yoast SEO and Rank Math detected on the same page
potential_conflicts:
- plugins: ["Yoast SEO", "Rank Math"]
risk: high
reason: Both plugins independently manage sitemaps, meta tags, and schema markup — running both typically produces duplicate or conflicting SEO output.
overall_risk_score: 0.78
recommendation: Deactivate one SEO plugin; both are feature-complete on their own.Best Practices
New conflicts are usually introduced by a recent install, not something that was always there — checking right after adding a plugin catches issues early, before they're hard to trace back.
This scan reads what's visible in your page's front-end markup — plugins that only run server-side (no visible script/style signature) won't be detected, so a clean scan doesn't guarantee zero conflicts.
The AI-suggested replacement isn't automatically compatible with your specific setup — check its own reviews and compatibility notes before switching a plugin your site depends on.
Frequently Asked Questions
It looks for the same front-end signatures browsers see — script/style handles, HTML comments, and CSS classes that specific plugins are known to output — not by accessing your WordPress admin or file system.
If a plugin does all its work server-side (e.g. a backend-only security or backup plugin) with no visible front-end footprint, it won't appear in a markup-based scan — this is a real, disclosed limitation, not a bug.
No — it only reports what it finds and suggests a course of action. You review the findings and make changes directly in your own WordPress admin.
Yes — the scan fetches your URL's public page markup directly, so password-protected staging environments can't be scanned this way.
AI Plugin Selector
Pick your site type and get a curated plugin stack, pulled live from WordPress.org and filtered to actively maintained options.
The WordPress.org plugin directory has over 60,000 plugins, and searching it directly means wading through outdated, abandoned, and poorly-rated results to find what actually works well for your specific type of site. A restaurant site and an online store need genuinely different plugin categories — reservations vs. payment gateways, menu display vs. inventory management.
This tool queries the WordPress.org API live for your selected site type, ranks results by real rating and install-count data, and automatically excludes plugins that haven't been updated in the last 18 months — so you're never recommended something that looks popular but has been abandoned by its developer.
Example: An E-Commerce site
Input: Website type = "E-Commerce Websites"
Payments & Store: WooCommerce (4.6★, 5M+ installs)
SEO: Yoast SEO (4.9★, 5M+ installs)
Security: Wordfence Security (4.7★, 4M+ installs)
Performance: WP Rocket (4.8★, 200K+ installs)
(each category returns its top-rated, actively maintained picks — stale results already filtered out)Best Practices
Ratings and install counts are strong signals, but always check a plugin's own support forum activity and changelog before installing it on a production site.
More active plugins means more potential conflicts and a heavier site. Start with the categories you genuinely need, and add more only as requirements grow.
The plugin landscape changes — a tool that was the best option a year ago may have been surpassed or abandoned since. Re-check your stack every so often, especially after a major WordPress core update.
Frequently Asked Questions
Yes — results come from the WordPress.org free plugin directory's public API, which has no pricing data for premium/paid plugins, so this tool can't evaluate cost or budget.
The plugin's last_updated date (returned directly by WordPress.org) is within roughly 18 months of today. Anything older is automatically excluded from the top picks shown to you.
It's a live WordPress.org API query ranked by real, current rating and install-count data — not an AI guess. The "AI" in the name refers to the curated category-matching logic, not a language model generating plugin names.
Not in a single run — pick the type that best matches your site's primary purpose. If your site spans multiple purposes (e.g. blog + store), run it once per type and combine the results.
Email Validator
Check an email address's syntax, real MX records, and whether it's a disposable/temporary address — in one lookup.
A valid-looking email address doesn't mean it can actually receive mail. Syntax checking alone catches typos, but it can't tell you whether the domain has a working mail server, or whether the address is from a disposable/temporary inbox service that people use specifically to bypass signup forms and never receive your emails.
This tool runs all three checks in one pass: syntax validation, a real-time MX record lookup against the domain's actual DNS to confirm it can receive mail, and a check against known disposable-email-domain lists. Useful before adding an address to a mailing list, a lead form, or a user registration flow.
Example: A disposable address
Input: test@mailinator.com
is_valid_syntax: true
has_mx_records: true
is_disposable: true
disposable_reason: mailinator.com is a known public disposable-email provider
overall: invalid — flagged as disposableBest Practices
Catching a disposable or non-existent address at the point of entry prevents bad data from ever reaching your list, rather than needing cleanup later.
A domain having valid MX records confirms it CAN receive mail — it doesn't confirm the specific mailbox exists or is still active. True deliverability confirmation ultimately requires an actual send.
An address that validated a year ago may have since been abandoned or had its domain's MX records removed — periodic re-validation keeps a list healthier than a one-time check.
Frequently Asked Questions
It confirms the domain (e.g. "example.com") has a mail server configured to receive email — a real-time DNS lookup, not a cached or guessed result. It doesn't confirm the specific mailbox exists.
Against a maintained list of known disposable/temporary email domains (services like Mailinator, Guerrilla Mail, and similar) — genuinely new disposable services that aren't yet on the list may not be caught.
No — this is a non-intrusive check (syntax, DNS, and domain-list lookup only). It never sends mail or pings the mail server directly, so there's no risk of alerting the address owner or triggering spam filters.
This version checks one address per request. A bulk variant isn't currently available on this tool.
wp-config Auditor
A security and best-practice audit of your wp-config.php, with a score out of 100 — secrets are redacted before anything reaches the AI.
wp-config.php is the single most security-sensitive file in any WordPress install — it holds your database credentials, authentication salts, and increasingly, feature flags like WP_DEBUG and DISALLOW_FILE_EDIT that determine how exposed your site is if something else goes wrong. Most security checklists tell you what settings to check; almost none actually read your real file and tell you what's missing.
This tool audits your actual wp-config.php for the issues that matter most in practice: debug mode left on in production, missing file-edit protections, weak or default table prefixes, missing auth keys/salts, and other common misconfigurations — then gives you a score and a prioritized list of fixes. Secret values (passwords, keys, salts) are redacted to the literal text [REDACTED] before the content is ever sent for analysis — the audit checks whether a constant is present and set, never what its actual value is.
Example: A config with two real issues
Input: define('WP_DEBUG', true); — no DISALLOW_FILE_EDIT constant present
finding 1 — setting: WP_DEBUG, severity: high
WP_DEBUG is enabled in what looks like a production environment.
→ Disable WP_DEBUG (or at minimum set WP_DEBUG_DISPLAY to false) — it can leak file paths and errors to visitors.
finding 2 — setting: DISALLOW_FILE_EDIT, severity: medium
DISALLOW_FILE_EDIT is not set.
→ Add define('DISALLOW_FILE_EDIT', true); to block the wp-admin theme/plugin file editor, a common post-compromise attack vector.
security_score: 62/100Best Practices
The audit checks for the ABSENCE of certain constants (like DISALLOW_FILE_EDIT) as well as their presence — pasting only part of the file can produce false "missing" findings.
The tool redacts DB_PASSWORD, AUTH_KEY, and all six salts before analysis — but as a general rule, avoid pasting config files into any web tool on a device you don't control.
Hosts often regenerate wp-config.php during a migration and can silently drop custom hardening constants you'd added — a quick re-audit catches this immediately.
Frequently Asked Questions
Password, auth key, and salt VALUES are stripped out (replaced with [REDACTED]) on the server before the content is ever sent to the AI model — the audit only ever sees whether those constants are present, never their actual contents.
It's a 0-100 composite based on how many best-practice constants are correctly set (DISALLOW_FILE_EDIT, FORCE_SSL_ADMIN, a non-default table prefix, etc.) versus missing or misconfigured — treat it as a quick health signal, not a formal audit.
The audit can't tell whether your site is a live production install or a local dev environment — WP_DEBUG being on is a real risk on production and completely normal on a dev site, so use judgment on that specific finding.
No — since the actual password value is redacted before analysis, the tool literally cannot see whether it's weak or strong. It only reports whether DB_PASSWORD is present at all.
WP Debug Log Analyzer
Paste a debug.log excerpt — get every error explained in plain language, with a likely cause and a concrete fix, powered by AI.
WordPress's debug.log (enabled via WP_DEBUG_LOG in wp-config.php) is often the fastest way to diagnose a broken plugin, a white screen of death, or a mysterious performance issue — but it's written for PHP, not people. A single fatal error can produce a wall of stack trace, deprecated-function warnings, and unrelated notices, and figuring out which line actually matters takes real WordPress debugging experience.
This tool reads your log excerpt and identifies every distinct issue — fatal errors, warnings, deprecated notices, PHP notices — then explains each one in plain language: what type of error it is, how severe it actually is, what's likely causing it, and a concrete next step to fix it. No account setup, no log file upload to a third party's permanent storage — you paste an excerpt, get an answer.
Example: A typical fatal error
Input: PHP Fatal error: Uncaught Error: Call to undefined function acf_add_local_field_group() in /wp-content/themes/mytheme/functions.php:42
error_type: fatal
severity: critical
summary: Uncaught Error calling an undefined ACF function
explanation: Your theme's functions.php calls a function from Advanced Custom Fields, but ACF isn't loaded when this code runs.
likely_cause: The ACF plugin is deactivated, not installed, or loads after your theme's functions.php runs.
suggested_fix: Confirm ACF (or ACF Pro) is installed and active. If it is, wrap the call in a function_exists() check or hook it to 'acf/init' so it only runs after ACF has loaded.
affected_file: /wp-content/themes/mytheme/functions.php:42Best Practices
Include the file path and line number if your log shows one — the more context in the excerpt, the more specific and accurate the diagnosis.
A page can have five "deprecated" notices and still work fine, but a single "fatal" error stops execution entirely. Fix criticals and highs first.
Debug logs occasionally include database query fragments or file paths that reveal your server structure — strip anything you wouldn't want stored, even temporarily, before submitting.
Frequently Asked Questions
Add these three lines to wp-config.php above the "That's all, stop editing!" comment: define('WP_DEBUG', true); define('WP_DEBUG_LOG', true); define('WP_DEBUG_DISPLAY', false); — errors will then be written to wp-content/debug.log instead of showing on your live site.
The content is sent to an AI model for analysis and isn't permanently stored for other users to see, but as a general practice, redact database credentials, API keys, or internal file paths first — the diagnosis rarely needs them.
You'll still get a structured breakdown of what type of issue it is and its severity — for genuinely ambiguous cases, the suggested fix will point you toward the next debugging step (e.g. "enable WP_DEBUG and reproduce with a specific plugin deactivated") rather than guessing.
Yes — debug.log can grow large over time and isn't meant to run indefinitely on production. Once you've resolved the issue, set WP_DEBUG and WP_DEBUG_LOG back to false.
.htaccess Generator
Generate a secure, production-ready .htaccess file for your WordPress site in seconds — no manual Apache configuration required.
The .htaccess file is a small configuration file that Apache reads on every request to your WordPress site — it's where you control redirects, security headers, caching rules, and access restrictions without touching PHP or your hosting panel. Most WordPress security guides recommend hardening it, but hand-writing Apache rewrite rules is easy to get wrong: one misplaced RewriteCond can redirect-loop your entire site or lock out legitimate visitors.
This generator produces battle-tested, standards-compliant rules for the six most common .htaccess hardening tasks — forcing HTTPS, normalizing your www/non-www URL structure, enabling Gzip compression and browser caching for faster page loads, blocking direct access to wp-config.php, disabling directory browsing, and blocking XML-RPC (a common brute-force target). Pick only what applies to your site; each rule is self-contained.
Example: A typical production setup
Force HTTPS + Block direct access to wp-config.php + Block xmlrpc.php enabled, WWW handling left unchanged
# Generated by AI Built Tools' .htaccess Generator
# Review before uploading — always keep a backup of your existing .htaccess
# Force HTTPS
RewriteEngine On
RewriteCond %{HTTPS} off
RewriteRule ^(.*)$ https://%{HTTP_HOST}%{REQUEST_URI} [L,R=301]
# Protect wp-config.php
<files wp-config.php>
order allow,deny
deny from all
</files>
# Block xmlrpc.php (a common brute-force/DDoS target)
<Files xmlrpc.php>
order deny,allow
deny from all
</Files>Best Practices
Download a copy of your current file via FTP or your hosting file manager before uploading a new one — if anything looks wrong after upload, you can revert in seconds.
Your browser caches redirects aggressively. Always verify HTTPS/WWW redirect rules in a private/incognito window, not your regular browser, or you may see stale results.
Blocking xmlrpc.php stops a common attack vector, but it also breaks the official WordPress mobile app and any Jetpack feature that depends on remote publishing.
Gzip compression and browser caching rules require these two Apache modules. Most managed WordPress hosts enable them by default — if pages don't shrink after uploading, ask your host to confirm.
Frequently Asked Questions
It's a plain-text Apache configuration file that lives in your WordPress site's root directory (the same folder as wp-config.php). Upload it via FTP, SFTP, or your hosting control panel's file manager — WordPress and most plugins never touch it directly, so it's safe to replace as long as you've backed up the original.
Each rule this tool generates is a standard, widely-used Apache directive — the same patterns recommended by WordPress.org's own hardening guide. That said, always back up your existing .htaccess first and test in an incognito window after uploading, since server configurations vary.
No. Apache reads .htaccess files on every single request, so changes take effect immediately — no restart, no cache clear on the server side. If you don't see the change, clear your own browser cache or test in a private window.
This only applies to Apache and LiteSpeed servers (the vast majority of shared/managed WordPress hosting). If your site runs on Nginx, .htaccess is ignored entirely — you'd need the equivalent rules added to your Nginx server block instead, usually by your host.
Yes, the rules don't conflict with each other. The one interaction worth knowing: combining "Force HTTPS" with "Redirect non-www to www" (or vice versa) means a visitor may briefly see two redirects in a row before landing on the final URL — still correct, just marginally slower on the very first request.
Serialized Search & Replace
Safely find and replace text inside PHP serialized data — WordPress options, postmeta, and theme settings — without corrupting the length prefixes.
WordPress stores a huge amount of data — widget settings, theme options, plugin configuration, some postmeta — as PHP's serialized string format, which looks like a:2:{s:4:"name";s:5:"Alice";}. The problem: every string inside that format is prefixed with its exact byte length (the s:5: part). Run a normal find-and-replace on serialized data with a text editor or a naive SQL query, and the moment your replacement text is a different length than the original, every length prefix after it goes stale — WordPress silently fails to unserialize the value, and the setting just disappears.
This is the single most common way a manual "search and replace my old domain across the database" migration breaks a WordPress site. This tool actually parses the serialized structure, walks every string value recursively, and re-serializes it correctly — so length prefixes are always accurate, regardless of how much your replacement text differs in length from the original.
Example: Migrating a domain inside a serialized option
Input: a:2:{s:4:"name";s:5:"Alice";s:3:"url";s:18:"https://old.com/wp";} — Search: https://old.com → Replace: https://newdomain.io
a:2:{s:4:"name";s:5:"Alice";s:3:"url";s:23:"https://newdomain.io/wp";}Best Practices
Copy the original serialized string somewhere safe first — if the replacement wasn't what you intended, you'll want the exact original to restore from.
Serialized string matching is case-sensitive and literal — "Http://old.com" won't match a search for "https://old.com". Copy the value directly from your database export rather than retyping it.
If you're about to repeat this across many postmeta/options rows, verify the output on a single real example first, then confirm it unserializes correctly in a PHP sandbox or staging site.
Frequently Asked Questions
Because serialized strings are length-prefixed (e.g. s:19:"..."), a plain text replace leaves the old byte-length in place even though the string itself changed length. WordPress then fails to unserialize the value — the setting silently breaks instead of updating.
No — you paste in a value and get back the corrected version as text. You're responsible for updating your database with the result (directly, or via a plugin like WP Migrate DB / Better Search Replace once you've confirmed the pattern works).
The tool detects this automatically and falls back to a plain text replace instead — you'll see a note in the result telling you which mode was used, so you always know whether length-prefix correction was actually needed.
Yes — the tool recursively walks the entire structure (arrays inside arrays, nested objects), not just the top level, and fixes length prefixes at every level that changed.
Certificate Bulk Generator
Turn a list of names into a batch of individual completion certificates — no design software required.
Course creators, workshop hosts, and training providers regularly need to issue a certificate of completion to every participant — and doing that one-by-one in a design tool doesn't scale past a handful of people. This tool takes a plain list of names and a course or event title, and generates a professionally laid-out certificate image for each name automatically.
Each certificate is rendered as its own PNG image inside a single ZIP download — ready to email individually, print, or attach to a completion record. Up to 30 names per batch keeps generation fast and the response size manageable.
Example: A 3-person workshop batch
Input: 3 names, course title "Advanced WordPress Security"
certificates_generated: 3
skipped_names: []
filename: certificates.zip
Contains:
Alice-Johnson.png
Bob-Smith.png
Carol-Lee.pngBest Practices
Whatever you type is rendered verbatim on the certificate — check spelling and capitalization before submitting, since there's no separate "display name" field.
The generator caps each run at 30 names to keep response times fast — for a larger cohort, run multiple batches rather than one very large list.
Very long course titles can wrap awkwardly on the fixed certificate layout — a short, clear title (under ~60 characters) renders most reliably.
Frequently Asked Questions
Not currently — this tool generates a single, clean, professionally designed template with the recipient name and course title filled in. Custom branding/logos aren't supported yet.
Each certificate is a high-resolution PNG image (1600x1131px, print-ready), bundled together in a single ZIP file you download once generation completes.
Yes — the tool accepts either one name per line or a comma-separated list, whichever is easier to paste from your existing spreadsheet or registration list.
The first 30 are processed normally; any names beyond that are listed separately in the result as "skipped" so you know exactly who to include in a follow-up batch.
Spreadsheet Diff
Compare two Excel workbooks and see exactly which cells changed, sheet by sheet — no manual side-by-side scrolling.
When a client sends back a revised pricing sheet, a budget gets updated, or a data export changes between two runs, manually scrolling two Excel windows side by side to spot what changed is slow and error-prone — especially on sheets with hundreds of rows, where a single changed value can hide in plain sight.
This tool compares an old and a new version of the same workbook, sheet by sheet, and reports exactly which cells changed — old value, new value, and which sheet and cell reference — plus which sheets exist only in one version and how many rows were added or removed. Comparison is positional (same row/column position across both files), not a smart reordering-aware diff.
Example: A revised pricing sheet
Input: pricing-v1.xlsx vs pricing-v2.xlsx, one "Products" sheet in both
sheets_compared: ["Products"]
sheets_only_in_old: []
sheets_only_in_new: []
cell_changes:
- sheet: Products, cell: C14, old_value: "49.99", new_value: "44.99"
- sheet: Products, cell: C22, old_value: "12.00", new_value: "15.00"
rows_added: 3
rows_removed: 0Best Practices
The tool matches sheets by name — if a sheet was renamed between versions, it'll show up as "only in old" and "only in new" rather than a single compared sheet.
If rows were reordered (not just edited), the diff will show many "changes" that are really just shifted positions — this tool is best suited to files where row/column structure stays consistent between versions.
For sheets beyond that, the result includes a "truncated" flag — split extremely large exports into smaller ranges for a complete comparison.
Frequently Asked Questions
The calculated/displayed values — if a cell contains a formula, the diff compares what that formula currently evaluates to, not the formula text itself.
It's reported separately under sheets_only_in_old or sheets_only_in_new rather than being compared cell-by-cell against nothing.
Only .xlsx (the modern Excel format) is currently supported. Export Google Sheets or older .xls files as .xlsx first via "File > Download > Microsoft Excel".
Yes, 1.5MB per file, with comparison capped at 2,000 rows per sheet — well beyond what a typical pricing sheet, budget, or small dataset needs.
WooCommerce CSV Fixer
Fix the most common product-import CSV problems automatically — price formatting, encoding, boolean fields, and duplicate SKUs.
Product CSVs exported from another platform or a client's spreadsheet almost never import cleanly into WooCommerce on the first try. Prices show up with currency symbols WooCommerce can't parse, "Published"/"In stock?" columns use "Yes"/"No" instead of WooCommerce's expected 1/0, and Windows-1252 curly quotes from an Excel export get mangled into garbled characters when the file is actually UTF-8.
This tool runs your CSV through the fixes that account for the vast majority of failed WooCommerce imports: encoding detection and correction, price field cleanup (strips currency symbols and thousands separators), boolean field normalization, and duplicate SKU detection — with a clear list of what was actually changed, so you can review before you import.
Example: A CSV exported from another platform
Input: products.csv — Regular price column has "$12.50", Published column has "yes"
rows_processed: 240
encoding_detected: utf-8-sig
price_fields_fixed: 240
boolean_fields_normalized: 240
duplicate_skus: ["SKU-1042"]
warnings:
- No 'SKU' column found for 12 rows — duplicate-SKU checking skipped for thoseBest Practices
The tool flags them but doesn't rename them for you — WooCommerce will either reject duplicate SKUs or silently overwrite one product with another, so resolve these manually first.
WooCommerce expects "Parent > Child" for category hierarchy. If your source used a different separator like "/", this tool flags it as a warning but doesn't auto-rewrite it — that's a judgment call about your category structure.
Even after cleaning, run the first 5-10 rows through a real WooCommerce import before committing to the full catalog, to catch anything specific to your store's configuration.
Frequently Asked Questions
Excel often saves CSVs in Windows-1252 encoding, but most modern tools (including WooCommerce's importer) expect UTF-8. This tool detects the actual encoding used and re-saves the file correctly as UTF-8.
The standard WooCommerce export columns: Published, Is featured?, In stock?, Backorders allowed?, Sold individually?, and Allow customer reviews? — values like yes/no, true/false, and Y/N are all normalized to WooCommerce's expected 1/0.
Only formatting — currency symbols and thousands separators are stripped so "$1,234.50" becomes "1234.50". The actual numeric value is never changed.
No — this tool focuses specifically on price formatting, boolean normalization, encoding, and SKU duplicates. Image URLs and description content are passed through unchanged.
EXIF Stripper
Remove GPS location, camera details, and timestamps hidden inside your photos before you publish or share them.
Every photo your phone or camera takes carries EXIF metadata — a hidden data block embedded in the file itself, invisible when you view the image normally. It typically includes the exact GPS coordinates where the photo was taken, your camera or phone model, the software used to edit it, and precise timestamps. Upload that photo to a blog post, a marketplace listing, or a public profile, and anyone who downloads the original file can extract that data.
This tool re-saves your image with all EXIF metadata removed — GPS location, device identity, and timestamps — while keeping the visible image itself pixel-for-pixel identical. It works entirely on the file you upload; nothing is stored after the response is returned.
Example: A phone photo with location data
Input: IMG_4821.jpg (3.2MB, from an iPhone with location services on)
removed_metadata:
- GPS location
- Camera manufacturer
- Camera model
- Original timestamp
- Editing software
original_size_bytes: 3,214,092
cleaned_size_bytes: 3,198,447Best Practices
Once an image has been shared or crawled, copies with the original metadata may already exist elsewhere — strip metadata as a standard pre-publish step, not a cleanup after the fact.
Stripping EXIF fixes photos you've already taken, but disabling location tagging in your phone's camera settings prevents it from being embedded in every future photo.
EXIF data is genuinely useful for photographers organizing a personal archive by date/location — strip a copy for public sharing, but keep your working original intact.
Frequently Asked Questions
No — this tool only removes the metadata block, not the pixel data. The visible image is unchanged; file size typically shrinks very slightly since the metadata itself takes up some space.
JPEG, PNG, WEBP, and TIFF — the four formats that commonly carry EXIF or similar metadata. Other formats aren't currently supported.
Yes — the tool removes all recognized metadata fields, including Artist and Copyright tags, not just location and device data. If you rely on embedded copyright metadata, keep an unstripped master copy.
Yes, 1.5MB per image — large enough for typical web-published photos, but if your camera shoots very high-resolution originals, you may need to resize first.
PDF Metadata Scrubber
Remove the author, title, creation software, and timestamp fields hidden inside your PDF's document properties.
Every PDF carries a Document Info dictionary — metadata fields like Author, Title, Creator application, Producer, and creation/modification timestamps — that most PDF viewers hide by default but anyone can inspect via "Document Properties" or a simple metadata reader. If you exported a contract from a shared company Word template, that PDF may still list the original author's name or your internal software stack, even after you've redacted the visible content.
This tool strips the Document Info dictionary and any embedded XMP metadata block from your PDF, while leaving every page's actual content byte-for-byte untouched. It's a one-way, one-time operation on the file you upload — nothing is retained afterward.
Example: A contract exported from Word
Input: NDA-draft.pdf, exported via "Save as PDF" from Microsoft Word
removed_metadata:
- Author
- Title
- Creator application
- Producer application
- Creation date
- Modification date
had_xmp_metadata: trueBest Practices
Once a PDF has been emailed, uploaded, or posted publicly, copies with the original metadata may already be out of your control — scrub it as a standard step before distribution.
Some tools (Word, Adobe Acrobat) let you strip metadata at export time — scrubbing after the fact fixes existing files, but preventing it at the source avoids the extra step going forward.
Encrypted/password-protected PDFs can't be processed — remove the password protection first if you need both encryption and metadata scrubbing.
Frequently Asked Questions
No — only the Document Info dictionary and XMP metadata are removed. Every page's visible content, layout, and formatting stays exactly as it was.
XMP is a separate, more detailed metadata format (Adobe's standard) that can be embedded alongside the simpler Document Info fields — many PDF viewers only show you one or the other. This tool removes both.
No — this tool only touches metadata, not the visible page content. True redaction (permanently removing visible text/images) is a different, more involved process.
Yes, 1.5MB — enough for most text-based documents, though PDFs with many embedded high-resolution images may exceed that.
Track-Changes Stripper
Accept every tracked change in a Word document at once and get back a clean, final copy — no clicking through revisions one by one.
A document that's been through several rounds of collaborative editing with Track Changes enabled often accumulates dozens of individual insertions, deletions, and formatting edits — all still visibly marked up even after everyone has agreed on the final version. Clicking "Accept" through each one manually in Word is tedious, and forgetting to accept even one can leave stray revision marks in a document you thought was final.
This tool reads the document's underlying tracked-change data directly and accepts every insertion, removes every deletion, and clears formatting-change markers in one pass — producing a genuinely clean .docx with zero tracked-change history remaining, ready to send or publish.
Example: A document after 3 rounds of review
Input: contract-v4-tracked.docx, with insertions/deletions from two reviewers
insertions_accepted: 14
deletions_accepted: 6
formatting_changes_cleared: 3
filename: cleaned-document.docxBest Practices
This process is irreversible in the output file — once changes are accepted, the individual revision history is gone. Keep your original tracked-changes .docx as a record of who changed what.
This tool accepts every tracked change unconditionally — it doesn't distinguish "approved" from "still under discussion." Only run it once every open comment/suggestion has genuinely been resolved.
This tool clears tracked insertions/deletions/formatting changes, not Word comments — review and resolve any comment bubbles in Word itself before or after using this tool.
Frequently Asked Questions
It accepts every tracked change — insertions become permanent text, deletions are permanently removed. If you need to reject changes instead (revert to the pre-edit original), use Word's own "Reject All" feature.
Yes — only the tracked-change markup itself is processed. Fonts, styles, headers/footers, and layout are untouched aside from formatting-change tracking markers being cleared.
It handles tracked text insertions and deletions throughout the document body, including inside tables. Complex tracked structural changes (like inserted/deleted images) are a less common case — verify the result if your document includes them.
Yes, 1.5MB — sufficient for the large majority of text documents, contracts, and reports.
GSC Analyzer
Upload a Search Console export and find striking-distance keywords and low-CTR pages worth fixing first.
Google Search Console shows you thousands of rows of query and page performance data, but it doesn't tell you which ones actually deserve your attention this week. Two opportunity types matter most: "striking-distance" keywords — ranking positions 4-20 with real impression volume, where a modest push could land page 1 — and high-impression pages with below-average click-through rate, which usually signal a title or meta description problem, not a ranking problem.
This tool reads your exported Performance report, automatically finds both opportunity types using real thresholds computed from your own data (not arbitrary fixed numbers), and feeds a data summary — not raw rows — to an AI model for 3-5 specific, prioritized recommendations grounded in what your actual numbers show.
Example: A Performance report export
Input: Queries.csv exported from Search Console's Performance report
rows_analyzed: 842
total_clicks: 3,120
total_impressions: 210,400
average_ctr: 1.48%
average_position: 14.2
striking_distance_opportunities: 23 found (position 4-20, high impressions)
low_ctr_opportunities: 17 found (ranking well, under-clicked)Best Practices
From Search Console, go to Performance > choose your date range > export as CSV. The tool needs the underlying query/page rows, not a screenshot or the top-level chart.
A short date range produces noisy position/CTR numbers for lower-traffic queries — a longer window gives the opportunity-detection thresholds more reliable data to work from.
A page ranking well but under-clicked is often a one-line title/meta-description fix, versus striking-distance keywords, which may need real content or backlink work to actually move.
Frequently Asked Questions
Search Console exports a CSV with columns like Query/Page, Clicks, Impressions, CTR, and Position — column naming varies slightly between "Top queries" and "Top pages" exports, and this tool matches both automatically.
Ranking position 4 through 20 with impressions in the top quartile of your own dataset — meaning the exact cutoff adapts to your site's real traffic distribution rather than a fixed number that might not fit a smaller or larger site.
A data summary (aggregated stats, not your raw row-by-row export) is sent to an AI model to generate recommendations — the file itself isn't retained after your request completes.
No — this is a CSV-export analyzer, not a live OAuth integration. You export the report from Search Console yourself and upload the file here, which avoids any account-connection setup.