WordPress Development Stack Exchange is a question and answer site for WordPress developers and administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I want to restrict access to some files uploaded via the admin interface but I cannot rely on the ability to use .htaccess (could be turned off, or they might be using a non-apache web server). I cannot rely on having access to a folder outside the web root, so is there either a directory protected from viewing in wordpress or some way wordpress enables writing files that cannot be viewed publicly?

share|improve this question
@Shazzad that will not stop anyone from viewing or downloading it. – Don Rhummy Apr 1 '14 at 23:30
strictly speaking, the answer is no, but if you explain what you're trying to do, perhaps a workable solution can be offered. – Milo Apr 1 '14 at 23:38
hash the filenames so they're not guessable, and serve them via php readfile. – Milo Apr 1 '14 at 23:41
though depending on how sensitive the documents are, I think nesting them in randomized folder names and hashing the filename is sufficiently obscure. if it's really that sensitive, requiring server-level security is not unreasonable. – Milo Apr 2 '14 at 1:57
You can use the attachment.php template to serve the files, so you never reveal the actual location to the end users and you can use that to lock down access as needed. Require log in and then give them the file from an obfuscated url. Of course the original file is still accessible, but they would have to know where to look. This doesn't require changing the file name. The only way to fully stop access to the actual file would be to use htaccess to redirect users to a gateway file. – Jake Apr 2 '14 at 2:12

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Browse other questions tagged or ask your own question.