First CH Apps / Photo Location Leak Check
Enter a page URL and we pair each photo on it with its WordPress original (full-size upload) and check whether the Exif still holds the shooting location (GPS latitude and longitude).
Photos taken on a phone often record where they were taken (GPS latitude and longitude). WordPress removes this when it creates resized copies, but the original file you uploaded is kept as it is. The photos on your page can be clean while anyone who opens the original's URL can still read the location. This tool pairs each displayed photo with its likely original and checks both.
Use a page with photos — your shop, staff or blog page. Up to 20 pairs (displayed photo + original candidate) are checked per page.
See a sample result (fictional site)
photo-768x512.jpgLocation is usually removed when resizedphoto.jpgThe full-size upload. It may still hold itWe strip WordPress's resize suffixes (-768x512, -scaled) to build the original's URL on the same server.
We look only at the Exif latitude and longitude tags (GPSLatitude and GPSLongitude). An image counts as "Location found" only when both hold valid values. The values themselves are never returned by the server or shown on screen.
"Not found" is not a guarantee. We check the first 20 JPEG pairs on the one page you enter. Other pages, other sizes of the same photo and non-Exif formats such as XMP are not checked.
Original candidates are built from WordPress's resize naming (-WIDTHxHEIGHT, -scaled). Sites that are not WordPress, or that rename files, get no candidate. A 404 means no original is public under that name.
Some image delivery services convert JPEG to WebP. Those show as "Out of scope" and we cannot tell whether the original file still holds a location.
Sent: only the URL you enter. Our server (Cloudflare Workers) makes DNS lookups to check the destination is safe, then fetches the page with a public GET (first 512KB). It then fetches the photos and original candidates found on the page one by one, asking only for the first 128KB, stopping after 5 seconds or 2 redirects, and re-checking the destination at every hop. Internal networks, localhost and private IPs are never fetched.
Stored: nothing. The URL, the HTML, the images and the result are never written to a database (no KV, no D1) and leave memory when the request ends.
Returned: the photo URLs, a state (found / not found / could not check / out of scope) and a reason. Coordinates, capture dates, image bytes and the page itself are never returned.
Rate: one check calls the server up to 4 times (five pairs each). Each client may call it 40 times per 10 minutes.
POST /gazou-ichijouhou/api/check with JSON ({"url": "https://example.com/", "offset": 0}) to get the list of pairs and the verdicts for five pairs starting at offset. offset is 0, 5, 10 or 15.