I would like to protect some uploaded files, so that they are not publicly accessible (they are not accessible without a login). I’m uploading some PDF files, and I’d like to mark some of them as protected, so they can’t be accessed without a login on the WordPress web site.
I’m currently using the Member Access, which lets me mark some posts and pages as protected (so only logged-in users can view them). This is great. However, it does not provide any way to protect media uploads (i.e., attachments).
Note that I do not want to protect all uploads, only some of them. Some uploads need to be accessible to the public, while others should only be accessible to logged-in users. I’d prefer to do this through the WordPress administration interface (not a hairy .htaccess file that has to be manually administered). I want something that is actually secure, not just security-through-obscurity.
How do I do this?
(I’ve read How to Protect Uploads, if User is not Logged In?, but it concerns methods to protect all uploads, not just some of them. I’ve read How to restrict access to uploaded files?, but it focuses on security-through-obscurity. This is close to simple solution for restricting access to (some) uploads/downloads, but I’d prefer a solution that can be administered through the web interface if possible.)
See my question and answer again, you linked it already in your question:
simple solution for restricting access to (some) uploads/downloads
The solution isn’t that hairy the only necessity – besides configuring the plugin correct – is to create a
.htaccess
, which you could do programmatically. For that you have to automate the creation of the.htaccess
file inside the configured folder of wp-downloadmanager. On the other hand, you obviously read that…You might want to take a look at this solution:
https://github.com/mattheu/Private-Media
I use the combination of these two plugins:
Create the Download page and facilitate uploading of new content:
http://wordpress.org/plugins/download-monitor/
Protect wordpress site to allow trusted users to access the site:
http://andrey.eto-ya.com/wordpress/my-plugins/trusted-only
Though I used it to protect the whole site not just specific downloads.