WordPress Development Stack Exchange is a question and answer site for WordPress developers and administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I am trying to protect the uploads directory with .htacess.

But when I browse media section in admin panel, I see user/pass popup.
My guess is, WordPress use fopen to find if the file exists. I found mod_rewrite rule allowing fopen but I can't figure out how to use those rules with basic HTTP authentication. Any help is highly appreciated.

following is the rewrite rules for allowing fopen:

RewriteEngine On  
RewriteBase /

RewriteCond %{THE_REQUEST} ^.+$ [NC]  
RewriteRule .* - [F,L]
share|improve this question
# Only allow access to this directory if they are coming from your domain; excluding you, your server, Google and any other IPs
RewriteEngine On
RewriteCond %{REMOTE_ADDR} !^(xxx\.xxx\.xxx\.xxx|xxx\.xxx\xxx\.xxx|66\.249\.)
RewriteCond %{HTTP_HOST} !^(127\.0\.0\.0|localhost) [NC]
RewriteCond %{HTTP_REFERER} !^https?://(.+\.)?yourdomain\.com/ [NC]
RewriteRule .* http://yourdomain.com/ [L]

That should help, I think

share|improve this answer
Thanks. but i have an .htpasswd file there too. i want to be able to allow users who have password. these rules don't seemed to do that. is there any way ?? – nur May 6 '12 at 19:34
Well, I think the user must enter the password manually each time if you use a .htpasswd file, but no idea, the example above will give access to users that are looged in (since these folders will require that by default on wordpress). and provided that they access the folder by following internal links within your site. Honestly I can't think on something better. (not an expert) – user983248 May 6 '12 at 22:38

See this popular answer, it works and is easy to use. You find the source als oin a Gist.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.