Sign in
Back to insights
A black and white print of a back garden, with a deck, a tree and a wooden chair, lying on a wooden table. One corner is peeled back to show a small amber map pin hidden underneath.

Do You Need to Remove EXIF Data Before Publishing Photos Online?

7 min read

Short answer: yes, remove the location before a photo goes on a public website. Keep the copyright details if you have them. Everything else is a matter of taste.

The part most guides skip is that your CMS is probably not doing this for you. WordPress, on the Imagick image library that many hosts use, is written to keep a photo's EXIF block when it makes the smaller copies your pages actually show. The comment in WordPress core's own source gives the reason: it holds orientation data. It also holds the GPS coordinates, because they live in the same block.

So a photo taken on a phone in your back garden can be published with your address inside it, by a site that resized it, renamed it and gave every sign of having processed it.

What a photo is carrying

EXIF is the block of data a camera writes into an image file alongside the picture. Most of it is harmless: the camera make and model, the exposure settings, the date and time the shutter fired.

The part that matters is the GPS section, which a phone fills in whenever its camera is allowed to use location. The standard tags include:

  • GPSLatitude and GPSLongitude, the coordinates
  • GPSAltitude, the height above or below sea level
  • GPSDateStamp and GPSTimeStamp, when the position was fixed, in UTC
  • GPSImgDirection, which way the camera was facing

Put together, that is not “somewhere in Cape Town”. It is a point on a map, a time, and a compass bearing. As an Army intelligence official at Fort Benning put it when warning soldiers in 2012, a GPS phone “will automatically embed the latitude and longitude within the photograph.” Nobody has to do anything for it to happen.

Two times it mattered

Four helicopters, 2007. The same Army article describes a unit arriving in Iraq with a fleet of new AH-64 Apaches. Soldiers photographed them on the flightline and the pictures went online. According to the Army, the enemy used the location data in those photos to find the exact position of the helicopters inside the compound, then mortared them. Four were destroyed.

One fugitive, 2012. When John McAfee was evading police in Central America, journalists from Vice found him and published a photo taken on an iPhone. A reader looked at the file's metadata and found it placed the picture beside a resort pool in Guatemala. McAfee later claimed he had altered the data himself to mislead people. Either way, the point stands: the location was in the published file, and the first person to look found it.

Most of us are neither a military base nor on the run. But the mechanism is identical for a product shot taken at your kitchen table or a portfolio photo taken from your front step, and it does not need anyone clever. Reading EXIF takes a free tool and a few seconds.

Your CMS is probably not removing it

It is reasonable to assume that a website which resizes and recompresses your photos has thrown the metadata away in the process. On WordPress that depends on which image library your host has installed, and the answer is not what most people expect.

WordPress has a setting called image_strip_meta, on by default, that strips metadata from resized images. But the function that does the stripping keeps a protected list. In WordPress core it names five kinds of metadata to leave alone: icc, icm, iptc, exif, xmp.

The EXIF block is on the keep list, so its GPS section survives into every size WordPress makes. The function's own description says it strips everything “except color profiles”, which is not what the code does. The other library WordPress supports, GD, strips all of it, so two identical WordPress sites can behave in opposite ways depending on their hosting.

There is a second route. Since WordPress 5.3, a photo wider or taller than 2,560 pixels gets a scaled-down copy that is used as the largest size, but the original file is kept in the uploads folder as well. A smaller photo is not scaled at all, so the file you uploaded is the file your visitors receive, metadata included.

We have not tested every hosting setup, and plugins can change all of this. The safe conclusion is not “WordPress leaks your location”. It is that you should not rely on your CMS to clean a file, because whether it does is decided by software you probably did not choose.

The metadata worth keeping

Stripping everything has one cost, and it is worth knowing before you do it. Google Images can show who owns a photo, using rights fields embedded in the file in a format called IPTC. Google lists the fields it reads:

  • Creator, usually the photographer
  • Credit Line
  • Copyright Notice
  • Web Statement of Rights, required for the photo to qualify
  • Licensor URL

These say who made the picture, not where it was taken, so they carry none of the risk above. If you sell photography or license images, they are worth keeping. Google also accepts the same details as structured data on the page instead, and if the two disagree it uses the structured data, so embedding them is one option rather than the only one.

What Google does not list anywhere in that documentation is GPS. There is no published reason to believe a photo's coordinates help it rank.

A workflow that does not depend on remembering

The failure mode here is never ignorance. It is the one photo out of forty that nobody checked. So the fix belongs in the steps you already take, not in an extra one:

  1. Decide at the camera.On an iPhone, Apple's own guidance is Settings, then Privacy & Security, then Location Services, then Camera, and set it to Never. If you would rather keep location for your own library, share with it off instead: tap Share, then Options, and turn off Location.
  2. Strip at export, not at upload. The cleaning should happen when the web copy is made, so that the only file which ever reaches your site is the clean one. Do not count on the CMS, for the reasons above.
  3. Add rights back deliberately, if you need them. Copyright and creator details are something you choose to add, not something to preserve by accident along with everything else.
  4. Check one published file. Download an image from your live page, not your own copy, and look at its info panel. That is the only test that tells you what visitors actually receive.

Questions people ask

Will removing EXIF hurt my SEO?

Removing the GPS section will not, as far as anything Google publishes says. The fields Google documents using are the IPTC rights fields above. What helps an image rank is its filename, its alt text and the page around it, which is covered in Image SEO in 2026.

Is the camera model and date a problem too?

Rarely. The date can matter if a photo shows somewhere you visit on a routine, and some people would rather not advertise their equipment. But the coordinates are the part that turns a picture into an address. If you only remove one thing, remove that.

What does Resiqo do?

Exports come out with all of it removed by default: location, camera data and everything else, because the browser builds a new file from the pixels rather than copying the old one. Your originals are never touched or uploaded. There is a “keep metadata” option for JPEG to JPEG exports, and it keeps the whole block, location included. We do not yet offer keeping the copyright details while dropping the location, which is the combination this article recommends, and we would rather say so than imply otherwise. For the naming side of the same export, see batch renaming images for SEO.

Sources: U.S. Army, Geotagging poses security risks (8 March 2012), for the 2007 Apache attack and the quoted official; Scientific American, McAfee's Rookie Mistake Gives Away His Location, for the Vice photo and its location; The Next Web, for McAfee's claim that he altered the data; ExifTool, GPS tags, for the tag names and what each holds; WordPress developer reference, WP_Image_Editor_Imagick::strip_meta, for the protected profiles list and its description; WordPress developer reference, image_strip_meta, for the default and the note that GD always strips; Make WordPress Core, Introducing handling of big images in WordPress 5.3, for the 2,560 pixel threshold and the kept original; Google Search Central, Image metadata in Google Images, for the IPTC fields and the structured data rule; Apple, Manage location metadata in Photos, for the iPhone steps. All pages read on 21 October 2026.