WordPress 7.1 fixes a failure in the REST attachments controller when attachment filesize metadata is not an integer. Real libraries can contain numeric strings, decimal strings, nulls, arrays, stale backup values, offloaded-media metadata, or custom-plugin fields. A broad database rewrite can damage valid records and erase the evidence needed to identify the writer.
Use this after a migration, media offload change, bulk optimizer, restore, WordPress 7.1 upgrade, or REST error involving attachment details.
Quick answer
Query a sample of attachment metadata without changing it, classify the stored types, and identify which plugin or migration wrote each unexpected value. On staging, create fixtures for integer, numeric string, decimal string, empty string, null, array, missing value, and an offloaded object. Request the attachment collection and detail routes with fields used by the editor. WordPress 7.1 should not fail on a non-integer value. Repair only records whose source and intended byte size are known, and keep a dry-run export before any batch update.
Test scenarios to run
Run the same controlled fixture across these branches. Write down the expected result before testing so a surprising response is easy to identify.
| Scenario | Fixture | Expected result |
|---|
| Integer | 245812 | REST response remains valid |
| Numeric string | 245812 as text | No controller failure |
| Malformed | array or null | Safe response and logged owner |
| Offloaded | no local file | No invented zero-byte repair |
Diagnostic table
Use this table to connect the observed behavior to evidence and a verification step.
| Action | Evidence | Verification |
|---|
| Classify stored metadata types | Export attachment ID, MIME type, source file, metadata type, stored filesize value, actual local or remote size, and the plugin that last wrote the record. | Every fixture returns valid JSON without a PHP fatal. |
| Reproduce REST fixtures | Test collection, detail, edit-context, search, pagination, media modal, featured image, and block-editor requests with every controlled metadata fixture. | Media modal and editor requests remain usable. |
| Identify the writing component | Compare administrator and unauthenticated responses, response codes, JSON types, PHP warnings, REST logs, and editor console errors. | Offloaded files are not assigned invented local sizes. |
| Repair known records in batches | For offloaded files, distinguish a missing local file from malformed metadata and verify the storage provider before deriving a replacement value. | Dry-run and post-repair exports reconcile by attachment ID. |
What to check first
- Export attachment ID, MIME type, source file, metadata type, stored filesize value, actual local or remote size, and the plugin that last wrote the record.
- Test collection, detail, edit-context, search, pagination, media modal, featured image, and block-editor requests with every controlled metadata fixture.
- Compare administrator and unauthenticated responses, response codes, JSON types, PHP warnings, REST logs, and editor console errors.
- For offloaded files, distinguish a missing local file from malformed metadata and verify the storage provider before deriving a replacement value.
- Run any repair as a dry run, save the affected IDs, update in small batches, clear only relevant caches, and re-fetch each repaired record.
Field notes
- Write the expected result before changing anything and keep one repeatable synthetic fixture for the full test window.
- Record exact versions and UTC timestamps because caches, retries, scheduled actions, and deployments can change the evidence between checks.
- Test the public path and the stored server-side result, not only an admin preview, isolated command, or API response.
- Review the result again after the relevant cache, queue, cron, webhook, and observation window has completed.
Useful command or data shape
Adapt paths, IDs, and privacy handling to the site before running commands or storing data on production.
wp db query "SELECT post_id, meta_value FROM wp_postmeta WHERE meta_key = '_wp_attachment_metadata' LIMIT 20"
curl -sS 'https://example.com/wp-json/wp/v2/media/ATTACHMENT_ID?context=edit'
# Inspect types on staging before writing any metadata.
Why this usually happens
- A migration serializes an integer as text or an unexpected structured value.
- An image optimizer writes partial metadata while another process reads it.
- An offload plugin removes the local file but leaves an incompatible filesize field.
- A repair script assumes every attachment has the same metadata shape.
Decision rule
Do not normalize the whole library. Repair only values whose owner and correct size are known, while proving the REST collection, detail route, editor, and offloaded-media path remain stable.
Production verification checklist
- Every fixture returns valid JSON without a PHP fatal.
- Media modal and editor requests remain usable.
- Offloaded files are not assigned invented local sizes.
- Dry-run and post-repair exports reconcile by attachment ID.
Safe fix order
Use a sequence that makes each result easy to prove. Stop when new evidence changes the scope or owner of the problem.
- Classify stored metadata types
- Reproduce REST fixtures
- Identify the writing component
- Repair known records in batches
- Recheck editor and API paths
Mistakes to avoid
- Changing production before recording exact versions, UTC timestamps, a stable fixture, the expected result, and a tested rollback point.
- Treating one successful screen as proof while logs, stored records, background jobs, caches, emails, APIs, and downstream systems remain unchecked.
- Testing only as an administrator instead of using the role, device, locale, cache state, request path, and failure branch that users actually reach.
- Leaving debug output, temporary exclusions, helper accounts, duplicate hooks, broad permissions, or relaxed firewall rules active after verification.
Questions teams ask during testing
Can I test this directly in production?
Start with read-only evidence. Use staging for code, package, security, checkout, form, privacy, or cache changes. If a production canary is necessary, make it identifiable, reversible, monitored, and incapable of exposing personal data or charging a customer.
How do I avoid a false positive?
Repeat the same fixture with the same versions, URL, role, locale, cache state, and downstream integration. Compare the public result, stored result, and logs instead of relying on one browser view.
What evidence should I retain?
Keep UTC time, exact versions, request or record ID, expected result, actual result, relevant log lines, change made, rollback point, owner, and final verification. Redact credentials, tokens, and personal data.
When is the work complete?
Close it when the primary path passes, failure branches are understood, stored and downstream records reconcile, temporary changes are removed, monitoring is active, and the owner has the evidence packet.
What to tell the client or owner
Give the owner a concise packet with the affected workflow, exact versions, UTC test time, synthetic fixture ID, expected result, actual result, key logs, change made, rollback point, final result, unresolved risks, owner, and next review date. Remove credentials and personal data before sharing it.
When HandL WP should help
Bring in help when this affects leads, checkout, search visibility, security, paid media reporting, or a client production site. HandL WP can trace the issue through WordPress, hosting, cache, tracking, and Search Console, then verify the workflow after the technical fix.
If this is active on a production site, have HandL WP audit WordPress media metadata.
Related HandL WP guides
Use these related guides when the same issue touches tracking, security, checkout, or crawler visibility.
Measure the malformed metadata blast radius
After one fixture passes, use the WordPress 7.1 REST attachment malformed metadata fleet report to group signatures by site, source state, storage provider, writer, REST result, and reversible repair batch.
Helpful references