The risky photo on a small publisher's site is rarely stolen on purpose. It is the one a contributor found somewhere, the one from an old post nobody remembers producing, the press image used a second year after the campaign ended. When a rights holder or a licensing agency comes asking, the question is never whether your intentions were good. It is whether you can show a licence.
Memory is not a system, and neither is a downloads folder. Agencies that enforce image rights at scale work from crawls and reverse image matching; they will find uses you forgot. The only variable you control is what your records say when they arrive.
Image identifier, ideally the file itself stored with the record or a thumbnail and filename that cannot drift. Source, the exact library, agency, photographer, or contributor it came from, with the account used. Licence type in the source's own terms, royalty free, editorial only, creative commons with its conditions spelled out, because creative commons is a family of different licences, not one permission.
Permitted uses and limits: commercial or editorial, web or print, territory, duration, and any credit requirement, copied at the time, since licence terms pages change. And the use log: each article, page, or product the image appears in, added when it is published, not remembered later. Five fields, one row, filled while the download tab is still open.
Contributor supplied images carry an assumption that the contributor had the rights. Put the warranty in the contributor agreement, and still record the image in the same system marked contributor supplied, because when an agency letter names that photo, your first need is finding every place it ran, and your second is the agreement you will be glad exists.
Press and publicity images arrive with implied permission for coverage of that launch, that book, that event. They are not a general library. Reusing a press still three years later in a listicle roundup is the classic small publisher infringement, and it happens because the image sat in the media library looking like stock. Tag press material with its campaign and a review date at upload.
Once a year, reverse image search a sample of your most visible pages, and reconcile your own media library against the licence log: images with no row are the work list. Retire or replace unlicensed orphans, especially on high traffic pages, because enforcement attention follows visibility.
When a demand arrives, do not panic and do not ignore it. Verify the claimant's right to the image, check your record, remove the image while you assess, and respond on the facts. A clean record and a fast takedown are the two things that most often turn a four figure demand into a closed file.
The image, its source and account, the licence type in the source's terms, the permitted uses including credit requirements, and a list of where the image has been published. Capture it at download time, when all five are in front of you.
Some are, some are not. Creative commons is a set of licences with different conditions: non commercial variants bar commercial use, and most require attribution in a specified form. Record the exact licence and its conditions for each image.
Press images are supplied to publicise a specific release or event, and the implied permission is tied to that coverage. Later unrelated reuse is a common infringement. Tag press assets with their campaign and treat later use as needing a licence.
Replace or remove it while you check, starting with high traffic pages. If a rights holder contacts you, verify their claim, show what you found, and act promptly; a missing record plus continued use is the worst combination.