External Images testing
Testing › External Images
Last full run: version 3.47.1 · 11 November 2026
Summary
External Images lets your products and posts show images that stay on your supplier’s server instead of being downloaded into your media library. This page lists the test suites we run for it, what each one proves, and the result of the last full run. Every suite runs on its own WordPress test site with WooCommerce and HPOS order storage switched on.
The images in these tests are real PNG files served by the test site itself, standing in for a supplier. Most suites block every other outgoing request, so no outside image host is ever contacted. A test passes only when the stored data, the page markup or what a real browser shows is right, not when the plugin merely reports success.
The release run
| Suite | What it proves | How it runs |
|---|---|---|
| Gallery, image sizes and lightbox | External images get a real width and height, so WooCommerce’s product gallery, hover zoom and enlarged lightbox show the image instead of a black screen. The placeholder size follows your store’s image shape, sizes written into an image URL are read and carried through, and products saved before the fix are handled too. Each check sits beside an ordinary product with a normal media library image, to prove the test itself is sound. | WordPress itself, rendering WooCommerce’s own gallery template |
| Variable products | No variation is given a blank image, a variation without its own image falls back to the parent’s, and a variable product with no external images is left untouched. | WordPress itself |
| Thumbnail URL and image cache limit | A separate thumbnail URL is used for small image sizes and the main image for large ones, on products and variations, and changes when you change it. With a cache size limit set, a visitor’s page view never deletes anything; the scheduled clean-up trims the cache in least-recently-used order and keeps images that were viewed recently. The thumbnail URL is also imported through WP All Import and Super Speedy Imports and read back in a fresh request. | WordPress itself, real image downloads over HTTP and WP-Cron run in a separate process |
| Image proxy and upgrades | The HTTPS image proxy is off unless you switch it on, so an upgrade never starts saving images to your disk on its own. When it is on, real image bytes and content types are served and cached, a cached image is still served while the supplier is down, and image checks report the real status of each URL. The silent database upgrade runs once and changes nothing on a site with nothing to convert. Viewing a page does not re-save an unchanged shared image, which on cached hosting had set off waves of cache purges. | WordPress itself, and real HTTP requests to the test site |
| Imports | Real imports through Super Speedy Imports and WP All Import’s own processor, first run and re-run: image URL order, duplicates, comma and pipe separators, empty updates, and that existing media library images are kept. Image file names containing letters such as ö and ä keep their own image, so two files whose names differ only by those letters are never mixed up. | The importers’ own code, in WordPress |
| Gallery options | The optional settings that add the featured image to the gallery, use the parent product’s gallery when a product has none, and show variation images in the main gallery, each tested in its own fresh WordPress process. | WordPress itself |
| Themes and gallery plugins | Real installed copies of the Houzez and Woodmart themes, Metabox, Additional Variation Images Gallery, Product Variation Gallery, Affiliate Coupons and Property Hive show external images correctly. Saving a product through wp-admin, WooCommerce or the REST API does not overwrite its stored gallery, with WooCommerce’s product caching both on and off. | WordPress itself and a real browser |
| Browser suite | Real pages in a real browser at desktop and phone width: images load at their true size, the lightbox and zoom work, choosing and resetting a variation swaps the image, social sharing (Open Graph) images, the fallback image, cropping, and saving settings. A user without permission, or with an invalid security token, cannot change settings. A separate journey goes from the settings page to the shop and product pages to check the thumbnail URL and cache limit settings. | Browser |
| AI and MCP tools | The tools External Images offers AI assistants read and change only what they should, refuse users without permission, and check images without contacting outside hosts. | WordPress itself |
| Security regressions | Every fix from our security reviews keeps working: an Author cannot plant script through an image URL, image title or custom field, cannot rewrite other users’ media, and cannot make the site fetch from internal addresses; a password-protected product does not reveal its images; on a multisite network a sub-site administrator cannot plant script in settings. | Browser, using wp-admin’s own forms |
Last full run: version 3.47.1
Run on 11 November 2026 with WooCommerce and HPOS. 6 checks failed. All 6 are three bugs we had already confirmed and recorded, listed below. No new failures were found.
| Suite | Result |
|---|---|
| Gallery, image sizes and lightbox | 83 of 83 passed |
| Variable products | 30 of 30 passed |
| Thumbnail URL and image cache limit | 81 of 81 passed. The 13 import checks need WP All Import Pro and Super Speedy Imports, which the main test site does not have, so they ran on a second test site that has both |
| Image proxy and upgrades | 49 of 50 passed. 1 known failure (bug 1 below) |
| Imports | 69 of 69 passed |
| Gallery options | 13 of 16 passed. 3 known failures, all with the add-featured-image-to-gallery option switched on (bug 2 below) |
| Themes and gallery plugins | 52 of 54 passed. 2 known failures (bug 3 below) |
| Browser suite | 16 of 16 tests passed, including the gallery plugin tests repeated with product caching on and off. Settings-to-storefront journey: 13 of 13 checks passed |
| AI and MCP tools | 13 of 13 passed |
| Security regressions | 17 of 17 passed |
The known failures
These are faults in the plugin, not in the tests. Each one was reproduced on a test site before it was recorded, and its test stays failing until the fault is fixed. We do not mark them as expected or skip them.
- A failed proxy download is cached as a blank image. With the image proxy switched on, if the supplier answers “not found” when the image is first fetched, a blank one-byte file is cached and served as if it were the image, and it stays that way. Successful downloads are cached correctly.
- The add-featured-image-to-gallery option repeats the featured image. This option is off by default and is switched on in code, not in the settings screen. When it is on, the featured image can appear twice in the gallery, and a product with no external image gets one empty gallery entry. The other gallery options pass.
- Deleting a Property Hive property can remove an image a WooCommerce variation also uses. When the same image URL is used by a property and by a product variation, both use one stored image. Deleting the property deletes that image, and the variation’s extra gallery image disappears. This only affects sites running both Property Hive and WooCommerce with shared image URLs.
Not part of this run
- A release gate on the download itself. External Images does not yet have a gate that installs the exact ZIP file built for release on a fresh site. These suites run on the plugin code.
- The deliberate-break check. A separate run cuts off one test image in the browser to prove the browser size check fails when it should. It is meant to fail, so it is not counted here.
What the tests do not cover
- Your supplier’s servers. Test images are served by the test site itself, so a slow or unusual image host is not tested. Failures are imitated with “not found”, redirect and connection-error responses.
- The exact pixel size of every image. When an image URL does not include its size, the server cannot know it without downloading the image. The tests check that the size given is sensible and has your store’s shape; the browser corrects it to the real size once the image loads.
- Some integrations. Datafeedr, Jetpack’s image service and persistent object caches such as Redis are not installed on the test sites, so they are not tested. Divi is not installed either; the gallery tests use Twenty Twenty-Five and Storefront, which switch on the same WooCommerce gallery features.
- Many visitors at once. Tests make one request at a time. Several visitors opening the same product at the same moment are not tested.
- Your server. Tests run on our development machine with one PHP version and one MariaDB version, not every host and database you might use.
- Every other plugin. Plugins and themes named above are tested with real installed copies. Other plugins on your site are not.
