Orphaner
Orphaner is a command-line tool that helps you identify and remove stale files from your Drupal site. It allows you to list files within a directory and then delete individual files, but it does not automatically determine if a file is safe to remove, leaving that decision to the administrator.
Orphaner
Why Orphaner?
Drupal sites can accumulate stale files over time through development, deployments, module removal, migrations, testing, or manual changes.
Orphaner provides a lightweight command-line interface for inspecting a directory and removing individual files without requiring a full filesystem management solution.
It intentionally does **not** attempt to automatically determine whether a file is truly "orphaned." The administrator is responsible for identifying files that are safe to remove.
Installation
Install the module with Composer:
composer require drupal/orphaner
Enable the module:
drush en orphaner
Clear Drupal caches if necessary:
drush cr
Usage
Show the module location
drush orphaner
This prints the absolute filesystem path to the Orphaner module.
List files
Use `--list` to recursively list files below a directory:
drush orphaner --list /var/www/html/web/modules/contrib/orphaner
Hidden files are included in the listing.
Delete a file
Use `--delete` to remove one file:
drush orphaner --delete /var/www/html/web/modules/contrib/orphaner/test/deleteme.php
Or use the shorter command alias:
drush orph --delete /path/to/file
Orphaner only permits deletion of regular files. It will refuse to delete directories and other filesystem objects.
Before deleting a file, the command verifies that it exists. After running `rm`, it also verifies that the file has actually been removed.
Command reference
| Command | Description |
| ----------------------------------- | ---------------------------------------- |
| `drush orphaner` | Print the installed Orphaner module path |
| `drush orphaner --list ` | Recursively list files |
| `drush orphaner --delete ` | Delete one regular file |
| `drush orph ...` | Alias for `drush orphaner` |
File deletion and safety
The `--delete` operation is intentionally limited to **one regular file at a time** and only to the Drupal project in context.
You cannot delete any file outside the Drupal project.
Orphaner:
* Checks that the supplied path exists.
* Refuses to delete directories.
* Refuses to delete anything that is not a regular file.
* Passes the path to Symfony Process as a separate argument rather than constructing a shell command.
* Uses `rm --
` to prevent a filename beginning with `-` from being interpreted as an `rm` option.
* Verifies that the file no longer exists after the command completes.
However, `--delete` is a destructive operation. Always verify the supplied path before executing the command.
Security
Do not use `--delete` unless you are certain that the specified file can safely be removed!
If you believe you have found a security vulnerability, please follow the Drupal project's security reporting process rather than publicly disclosing the vulnerability in the issue queue.