mThumb - A secure TimThumb alternative for easily resizing images.
Switch branches/tags
Nothing to show
Clone or download
Fetching latest commit…
Cannot retrieve the latest commit at this time.
Failed to load latest commit information.
tests 1.0 release Nov 13, 2014
.gitattributes first commit Dec 21, 2013
.gitignore getting close to 1.0 Nov 13, 2014
LICENSE Initial commit Dec 21, 2013 3.0.1 updates Feb 22, 2016
mthumb-config.example.php Updated example config file Mar 24, 2015
mthumb.php 3.0.1 updates Feb 22, 2016

mThumb (a secure PHP image resize script)

A secure, slimmed down version of the ol' standby TimThumb.

Project Goals

Like many WordPress developers we've been making use of the old TimThumb script for years. It works well and offers features not yet available in other projects, like BFI_Thumb (although that does look like a promising start). However, we've still got a lot of sites that we are supporting that require some of TimThumb's more advanced features like crop positioning and filters.

So we decided to create a leaner, meaner, MUCH MORE SECURE fork of TimThumb. To that end we've foregone full backward compatibility with the old TimThumb code. Here are the major changes:

  • Removed the WebShots features entirely
  • Removed the PHP Memory settings entirely
  • Disabled all remote/external sites by default
  • Removed option to allow all remote sites
  • Changed cache folder to use system cache by default
  • Increased default caching time and time between cleans
  • Increased default allowed file size and dimensions
  • Enabled PNG compression by default
  • Enabled PNG transparency by default
  • Removed error output that revealed script versions and error images
  • Tilde support in URLs (for user home directories was added)
  • Code cleanup and PHP docblock comments
  • Added check to ensure class was defined before calling start method

Get Involved

You can help out by testing this and reporting bugs. We ARE NOT interested in preserving 100% compatibility with all of TimThumb's less frequently used features as mentioned above but we ARE VERY motivated to make sure this code is secure. So any security issues will be dealt with immediately.

Pull requests are most welcome. Cheers.

mThumb Parameters

stands for values What it does
src source url to image Tells mThumb which image to resize › mThumb basic properties tutorial
w width the width to resize to Remove the width to scale proportionally (will then need the height) › mThumb width tutorial
h height the height to resize to Remove the height to scale proportionally (will then need the width) › mThumb height tutorial
q quality 0 – 100 Compression quality. The higher the number the nicer the image will look. I wouldn’t recommend going any higher than about 95 else the image will get too large › mThumb image quality tutorial
a alignment c, t, l, r, b, tl, tr, bl, br Crop alignment. c = center, t = top, b = bottom, r = right, l = left. The positions can be joined to create diagonal positions › mThumb crop position tutorial
zc zoom / crop 0, 1, 2, 3 Change the cropping and scaling settings › mThumb crop scaling tutorial
f filters too many to mention Let’s you apply image filters to change the resized picture. For instance you can change brightness/ contrast or even blur the image › mThumb image filter tutorial
s sharpen Apply a sharpen filter to the image, makes scaled down images look a little crisper › tutorial
cc canvas colour hexadecimal colour value (#ffffff) Change background colour. Most used when changing the zoom and crop settings, which in turn can add borders to the image.
ct canvas transparency true (1) Use transparency and ignore background colour

Configuration Constants

You can override certain built in settings in mThumb. by creating a config file called mthumb-config.php and would contain a series of define statements that change default settings.

There are a whole bunch of settings that are not controlled by the normal query string parameters.

constant values What it does
DEBUG_ON true/ false Turn on debug logging to the standard PHP error log
DEBUG_LEVEL 1, 2, 3 Debug level 1 is less noisy and level 3 is the most noisy
ALLOW_EXTERNAL true/ false Allow images from external sites to be resized. Restricted to the images defined in the $allowed_sites array.
FILE_CACHE_ENABLED true/ false Should we cache the files on disk to speed up your website? (hint: the answer is yes, unless you’re testing/ developing things! :))
FILE_CACHE_TIME_BETWEEN_CLEANS 86400 (milliseconds) mThumb automatically cleans up the cached files. This defines the amount of time between the different the cache cleaning.
FILE_CACHE_MAX_FILE_AGE 86400 (milliseconds) How old should a file be before it’s cleaned?
FILE_CACHE_SUFFIX .txt What to put at the end of all files in the cache directory so we can identify them easily
FILE_CACHE_PREFIX mthumb What to put at the start of the cache files so we can identify them easily
FILE_CACHE_DIRECTORY .system temporary directory the name of the image cache directory. Left blank it will use the system temporary directory (which is better for security, but is not supported by all web hosts)
MAX_FILE_SIZE 10485760 10 Megs is 10485760. This is the max internal or external file size that we’ll process
CURL_TIMEOUT 20 Timeout duration for Curl. This only applies if you have Curl installed and aren’t using PHP’s default URL fetching mechanism.
WAIT_BETWEEN_FETCH_ERRORS 20 Time to wait between errors fetching remote file.
BROWSER_CACHE_MAX_AGE 864000 Browser cache duration (to prevent images from being reloaded more than once – the higher the number the better).
BROWSER_CACHE_DISABLE true/ false Use for testing if you want to disable browser caching.
MAX_WIDTH 3600 Put a sensible limit of the width of the resized image (so that crazy large images can’t be created)
MAX_HEIGHT 3600 Put a sensible limit of the height of the resized image (so that crazy large images can’t be created)
PNG_IS_TRANSPARENT TRUE Define if a png image should have a transparent background color. Use False value if you want to display a custom coloured canvas_colour


  • 3.0.1 - Bugfix for unwritable cache folder
  • 3.0 - Version number update to calm down some automated scanners that think this is an old version of TimThumb
  • 1.0 - First proper release