Symelo Image Optimizations Pro

Symelo Image Optimizations Pro is an add-on for the free Symelo Image Optimizations plugin. It is sold and updated by Symelo LTD on symelo.com, not on WordPress.org.

Symelo Image Optimizations works with PHP's image libraries (Imagick and GD). Pro adds the dedicated encoders, which are often faster and compress better:

• WebP: cwebp, and gif2webp, which keeps GIF animations.
• AVIF: avifenc (libavif), for servers whose Imagick and GD can't write AVIF.
• JPEG: jpegoptim (with mozjpeg) and jpegtran, including truly lossless JPEG optimization.
• PNG: pngquant (colour reduction) and oxipng (lossless).
• PDF compression: qpdf, lossless. Ghostscript for lossy PDF compression, only when you choose it for PDFs.

The encoders appear on Media → Image Optimizations → Engines, next to Imagick and GD. Automatic puts them first; you can still choose the engine for each job. They follow Advanced → Background speed: lower CPU and disk priority and fewer threads on Normal and Gentle.

Where the encoders come from

• Installed on the server: programs your host installed in the system folders (/usr/local/bin, /usr/bin, /bin, /opt/homebrew/bin, /opt/local/bin), or in a folder you set with define( 'SYMELO_IMAGES_TOOLS_DIR', '/path' ); in wp-config.php.
• Managed tools (optional, off by default): when the server lacks an encoder or has an outdated one, Pro can download official builds from the projects themselves. Each build is pinned to an exact version and SHA-256 checksum, verified before it is unpacked, test-run, and checked again before it is used. Updates of Pro bring newer pinned builds, installed in the background. They are stored in uploads/symelo-images-pro/tools.

Versions with known security problems are refused (minimums: cwebp and gif2webp 1.3.2, avifenc 1.3.0, jpegtran 2.1.0, jpegoptim 1.5.3, oxipng 8.0.0, pngquant 2.12.0, qpdf 11.9.1, Ghostscript 10.08.0), and Site Health reports them.

Requirements

• Symelo Image Optimizations 1.0.0 or newer, active (API version 1.x). Without it, Pro only shows a notice.
• PHP's proc_open function must be allowed (many shared hosts disable it). Without it, Pro's encoders can't run; Site Health and the Engines tab say so.
• Managed tools: Linux on x86_64 or aarch64 (avifenc and jpegoptim builds: x86_64 only), an uploads folder from which programs may run, and file changes allowed (DISALLOW_FILE_MODS off). On other servers, use encoders your host installs.

Security

• Programs run without a shell, with fixed argument lists, a minimal environment and time limits. Program paths can't be entered in the admin; only the managed folder, SYMELO_IMAGES_TOOLS_DIR and the system folders are searched.
• Managed builds come only from the URLs pinned in the plugin, and only the named program (and qpdf's libraries) is extracted. A build that changed on disk is no longer used, and Site Health reports it.
• uploads/symelo-images-pro is protected with .htaccess and web.config files. On Nginx, add location ^~ /wp-content/uploads/symelo-images-pro/ { deny all; } to the server configuration.
• Every admin action checks the plugin's capability (administrators) and a nonce.

External services

Pro only contacts outside servers when you turn on Use managed tools and then click Install tools (or run wp symelo-images-pro tools install, or POST /wp-json/symelo-images-pro/v1/tools with install), and in the background after a Pro update or when an installed build is missing or changed, to download the pinned builds. Each download is a plain HTTPS request for a public file. Like every request WordPress makes, it carries your server's IP address and WordPress's standard user agent (the WordPress version and your site's address); no other data is sent.

• Google (downloads.webmproject.org on storage.googleapis.com): libwebp release archives (cwebp, gif2webp). Google Terms of Service, Privacy Policy.
• GitHub (github.com release assets, served from objects.githubusercontent.com): release archives of AOMediaCodec/libavif (avifenc), tjko/jpegoptim, oxipng/oxipng and qpdf/qpdf. GitHub Terms of Service, Privacy Statement.

With managed tools off (the default), Pro never contacts these services.

For developers

Constants: SYMELO_IMAGES_USE_TOOLS (true/false, locks "Use command-line encoders"), SYMELO_IMAGES_MANAGED_TOOLS (true/false, locks "Use managed tools"), SYMELO_IMAGES_TOOLS_DIR (an extra folder with encoders, searched before the system folders).

REST API (administrators): GET /wp-json/symelo-images-pro/v1/settings (every module's settings and which are fixed in wp-config.php), POST /wp-json/symelo-images-pro/v1/settings with {"module": "encoders", "values": {"managed_tools": true}} (partial update), GET /wp-json/symelo-images-pro/v1/tools (the encoders found, managed builds, engine per job), POST /wp-json/symelo-images-pro/v1/tools with action = detect, install or remove. GET /wp-json/symelo-images/v1/status also gets a pro key.

WP-CLI: wp symelo-images-pro tools [list|detect|install|remove].

Hooks: symelo_images_pro_modules (filter: add modules), symelo_images_pro_loaded, symelo_images_pro_settings_saved, symelo_images_pro_upgraded (actions). See docs/architecture.md.

1. Install and activate Symelo Image Optimizations (from WordPress.org).
2. Upload the Symelo Image Optimizations Pro .zip under Plugins → Add New Plugin → Upload Plugin, then activate it.
3. Go to Media → Image Optimizations → Engines. The "Command-line encoders" card lists what was found.
4. Optional: tick "Use managed tools", save, then click "Install tools".