For a site I'm setting up I was looking into the whole field of securing uploads/downloads and restricting access to them based on user roles/capabilities. Of course I have read some of the previous questions related to the (general) topic on here, for reference reasons the most important/interesting ones I found:
- How to Protect Uploads, if User is not Logged In?
- How to restrict access to uploaded files?
- Restricting access to files within a specific folder
- How to make media upload private?
- Merging PHP download script into `functions.php`
Generally it is not a bad idea to additionally improve security of your wordpress installation - for example protecting your
wp-config.php - there are a lot of things you can and should do. There is a ton of information out there how to do it. I'm in the context of this question mostly concernd about my uploads/downloads.
Wordpress uploads aren't secured, everybody can browse the
uploads folder, unless you prevent it with a
Options All -Indexes
.htaccess file has to be placed inside the
uploads folder. But that isn't really securing them, it just makes it harder to find the files. Additionally you can prevent
hotlinking, esentially restricting access based on
referrer - although that is little bit differnt case i thought i mention it, I'm not further elaborating, you can find plenty of information about that.
Of course has the possibility to make posts private or create a custom post type with suitable template files to make that post type private, but thats not securing your files. Same can be said for wrapping the files in conditionals like
On a sidenote there are plenty of plugins out there which are promising to make your files secure and protected, but many of them are just pretending to do so, some of the reasons are above. I'm just poiting that out because I'm pretty sure that it is not known by everyboby - so, be aware of that.
My intention was to be able to restrict access to (some) uploads and respectively downloads. And to make sure that nobody unwanted could have access to them, not by chance or if that someone knew the filename, the files should be really private and secure. After all only certain people should have access without exceptions.
Additionally i had no need to privatize the whole site, indeed that would be counterproductive - it is used for public presentation purposes. Further more i wanted the solution to be easily usable, for the simple reason that some of the people working with it are not exactly computer experts, as it is often the case.
Hence the question, is there an (relatively) simple way to restrict access to (some) uploads and the respective downloads? And like I carried out, that means a way to really protect and secure them?