hide/protect original full-size images

Question

I was hoping it would be possible to save original images to a separate directory to the resized images so that they could be safely hidden but this seems to be too difficult.

So I am now asking if there are any ways of protecting original full-size images from public but still allow them to view the re-sized images.

I'm not talking about hiding/protecting images on screen, moreover ways of giving original images unguessable url's or some such scheme to stop them from possibly being downloaded.

ie.

uploads/my_image-200x200.jpg (given this url)

uploads/my_image.jpg (this url can be easily worked out)

Answer 1

I was looking for a way to do this and found this page... then I thought of putting this in a .htaccess file in the WordPress uploads folder and it works for me so far... any good?

<FilesMatch "\.jpg$">
    order allow,deny
    deny from all
</FilesMatch>

<FilesMatch "-[0-9]+x[0-9]+\.jpg$">
    order allow,deny
    allow from all
</FilesMatch>

The first part denies access to all .jpg files and the second part searches for files with a size appended to the filename and allows access to those... you could also add directives for any other .jpg files that need to be viewable but all my other graphics are .png files so it's not a problem for me.

Answer 2

There's only one thing I know for sure - your images will be NEVER secure if you display their thumbnails based on the real URL.

But I have a few ideas, the first one looks great and should work for you. Mixing them together will make accessing your images much more harder.

Edit wp-includes\media.php file.

Line 435:

$suffix = "{$dst_w}x{$dst_h}";

$info = pathinfo($file);
$dir = $info['dirname'];
$ext = $info['extension'];
$name = wp_basename($file, ".$ext");

Playing with $suffix and $name could do the thing, give it a try.

Eg. changing $sufix to "something" will output thumbnail names as:

uploads/my_image-something.jpg

Still easy to guess, but what will happen when you add something before "my_image"? Something random + random jpgs names = seems pretty secure to me :)

Use TimThumb.

It creates thumbnails "on the fly", eg. you have www.domain.com/myimage.jpg and you want to display 200x200 thumbnail, so you just put timthumb.php wherever you want and then write something like:

<img src="timthumb.php?src=www.domain.com/myimage.jpg&h=200&w=200&zc=1" alt=""> 

It's not perfect but always harder than plain link, especially when it comes to bot image harvesting.

Use Watermark plugin.

Probably the most "secure" option, especially when you create thumbnails before adding watermarks to the full size images.

Answer 3

Why go through the trouble , it's possible but it requires jumping through all sorts of hoops and using more resources. You can use fopen , the database or nested php files, for instance have a look at php image protect class

Is this for people or bots?

Answer 4

Use the Next Gen Gallery plugin: Thumbnails are given different file names and galleries and posts can have many to many relationship. NextGEN Gallery

Answer 5

If you do not mind editing the Wordpress core I found a few places that might be worth a look.

Trolling through wp-admin/includes/media-upload.php lead me to media_handle_upload() (line #186) and image_resize() (line #405 of wp-includes/media.php).

media_handle_upload() deals with the media form submission.

image_resize() handles in the very least the name of a resized image (e.g. filename.jpg resized to filename-200x200.jpeg).

I also found wp_create_thumbnail() (line #23 of wp-includes/wp-admin/image.php) which has a filter of 'wp_create_thumbnail' called after the above mentioned image_resize() if you wanted to try to go the pluggable route.

Answer 6

Try this plugin that protects the image from "view image" http://wordpress.org/support/topic/great-plugin-to-protect-content-amp-images-of-your-blog