BitSplit Media Delivery

BitSplit changes the delivery workflow for public WordPress images. Instead of leaving a finished image at one public URL, it converts the original and generated sizes to incomplete BitSplit blocks. The browser obtains short-lived reconstruction data and rebuilds each image on demand.

Learn more at bitsplit.site.

This adds friction to:

• direct “copy URL and download” workflows;
• hotlinking;
• generic image downloaders and scrapers;
• bulk collection of ready-to-use image files.

BitSplit is not encryption, DRM, or a promise that downloading is impossible. A determined viewer can inspect the browser flow, automate reconstruction, or capture rendered content. Use it when raising the cost of casual downloading is valuable; use established encryption and access control when confidentiality is required.

Included functionality

The plugin protects any number of image attachments. All image functionality shipped in this WordPress.org package is available without payment, a license, a trial, or a usage quota.

It includes public or logged-in-only access, Gutenberg image support, featured-image and srcset handling, and backup/recovery tools.

Delivery flow

1. WordPress stores each image as an incomplete BitSplit block, with reconstruction data stored separately in attachment metadata.
2. Front-end image markup receives a placeholder instead of the original image URL.
3. The browser establishes an ephemeral P-256 ECDH session.
4. Reconstruction data is transported with HKDF and AES-256-GCM.
5. Block bytes require a short-lived, session-bound signed token.
6. The browser reconstructs the image into a temporary Blob URL.

The transport encryption protects reconstruction data in transit; the BitSplit block itself is not encrypted and contains most source bytes.

Access modes

• Public visitors – public images remain viewable; BitSplit adds download and scraping friction.
• Logged-in users only – anonymous visitors cannot obtain reconstruction data or block bytes.

WordPress coverage

BitSplit handles normal attachment images, Gutenberg Image and Gallery blocks, featured images, srcset, classic content containing wp-image-ID, and the [bitsplit id=”123″] shortcode.

Storage

Incomplete blocks are stored in a plugin-owned directory resolved through wp_upload_dir(), while reconstruction data stays in WordPress post metadata. The plugin does not write web-server configuration files or require users to edit server configuration.

Requirements

• PHP 7.4 or newer
• GMP extension
• OpenSSL with ECDH support