+- Data-Forums (https://data-forums.com/forum)
+-- Forum: DF Premium (https://data-forums.com/forum/Forum-DF-Premium)
+--- Forum: MyBB Premium Plugins & Themes (https://data-forums.com/forum/Forum-MyBB-Premium-Plugins-Themes)
+--- Thread: Mybb Premium Plugin DF External Image Privacy v1.0.0 — Click-to-load externally hosted post images (/Thread-Mybb-Premium-Plugin-DF-External-Image-Privacy-v1-0-0-%E2%80%94-Click-to-load-externally-hosted-post-images)
DF External Image Privacy v1.0.0 — Click-to-load externally hosted post images - Sir-Vigu - 10-21-2026
Verification record: DFV-AUDIT-20261021
Updated 21 October 2026 by Sir-Vigu. This is a scoped package-availability and staging audit, not a blanket security or compatibility certificate.
DF External Image Privacy — Previously staging-checked
The 1.0.0 release was staging-tested in the preceding batch (77 scoped assertions across that five-plugin batch). This pass confirmed the private archive exists and matched its inventory hash; no new universal compatibility/security certification is implied. Existing release screenshots and detailed boundaries remain below.
Vault download (existing access rules apply)
Complete MyBB Vault verification register
Original release notes
🛡️ DF External Image Privacy v1.0.0
Click-to-load externally hosted post images
![[Image: df-external-image-privacy.webp]](https://data-forums.com/images/vault-releases-20261021/df-external-image-privacy.webp)
Screenshot from the isolated MyBB test forum; this is not a claim that the plugin is enabled on production Data-Forums.
What it is
Replace external MyCode images with permission-to-load controls. Local images remain visible; allowlisted hosts are configurable. No proxy or server-side URL fetch.
What it does / Features
- Externally hosted post images become an explicit click-to-load control.
- Local board-host images and exact ACP-allowlisted external hosts remain visible.
- The prompt names the external host and explains the IP-address disclosure.
- Loads one selected image at a time with referrerPolicy=no-referrer.
- Reports successful loads and failures without silently loading all images.
- No proxy, remote URL fetcher or new database table.
What is inside the download
Code:
inc/plugins/dfimageprivacy.php
jscripts/dfimageprivacy/main.js
jscripts/dfimageprivacy/style.css
README.md
CHANGELOG.md
SECURITY.md
TESTING.md
LICENSE.txt
release.jsonRequirements
MyBB 1.8.40 is the tested target. PHP 8.1+ intended; runtime tests used PHP 8.4.26 and MariaDB 11.8.6. Use staging first on older MyBB releases or custom themes/editors. No API key or CDN dependency.
Install — step by step
1. Back up your forum files and database. Test on staging first.
2. Extract the ZIP. Upload the inc/ and jscripts/ directories to your MyBB root, preserving those paths. Do not upload to the ACP directory.
3. Admin CP → Configuration → Plugins → DF External Image Privacy → Install & Activate.
4. Admin CP → Configuration → Settings → DF External Image Privacy; review the settings below.
5. Try the example on a test thread before announcing it to members.
Settings
Enable DF External Image Privacy: on/off. Allowed external hosts: comma- or space-separated exact hostnames; no wildcard or implicit subdomain matching.
How to use
Code:
[img]https://external.example.test/diagram.png[/img]
Use an image URL you control when testing. The hostname above is an example, not a live image service.Testing — evidence and boundaries
Real MyBB post parsing; local image preserved; exact hostname allowlist; subdomain not automatically trusted; zero external image requests before consent; one request after click; missing Referer header; load feedback; lifecycle.
Tested in an isolated stock MyBB 1.8.40 forum with PHP 8.4.26, MariaDB 11.8.6 and Chromium. The batch passed 25 PHP/MyBB integration assertions, 26 browser assertions and 26 lifecycle assertions. These are scoped tests, not a third-party security audit. Older MyBB releases, other SQL engines, Safari/Firefox and third-party themes/editors are not certified by this test run. These five plugins are distribution releases and are NOT enabled on the production Data-Forums forum.
Known limitations / privacy
Applies to images produced inside MyBB post parsing, not avatars, signatures outside that path, theme banners, raw HTML widgets, scripts, iframes or every possible tracking source. It does not anonymize a request after a reader opts to load it: the image host can still see their IP. Third-party image-proxy plugins may change the apparent hostname and require separate testing. JavaScript is needed to load a withheld image. The example hostname is not a real service.
Deactivate / uninstall
Admin CP → Plugins → Deactivate stops the plugin on subsequent requests and keeps its configuration/data. Uninstall removes this plugin’s settings. Existing posts and member content are not deleted.
Changelog
1.0.0 — 21 October 2026: initial release. No earlier version to upgrade from.
Download from the DF Vault
Download DF External Image Privacy v1.0.0 ZIP
View the Vault entry
Existing Vault unlock rules and membership download allowances remain unchanged. This release does not introduce a new payment or bypass a member gate.
Support
Reply below with your MyBB/PHP version, theme/editor and reproduction steps, or PM Sir-Vigu. Redact passwords, cookies and private member information.
Licence
GPL-3.0-or-later; full licence included. Built by DF Studio / Data-Forums. No promised search ranking, revenue result or third-party security certification.