I want to restrict access to some files uploaded via the admin interface but I cannot rely on the ability to use .htaccess (could be turned off, or they might be using a non-apache web server). I cannot rely on having access to a folder outside the web root, so is there either a directory protected from viewing in wordpress or some way wordpress enables writing files that cannot be viewed publicly?

  • 2
    @Shazzad that will not stop anyone from viewing or downloading it.
    – Don Rhummy
    Apr 1, 2014 at 23:30
  • 1
    strictly speaking, the answer is no, but if you explain what you're trying to do, perhaps a workable solution can be offered.
    – Milo
    Apr 1, 2014 at 23:38
  • 1
    hash the filenames so they're not guessable, and serve them via php readfile.
    – Milo
    Apr 1, 2014 at 23:41
  • 1
    though depending on how sensitive the documents are, I think nesting them in randomized folder names and hashing the filename is sufficiently obscure. if it's really that sensitive, requiring server-level security is not unreasonable.
    – Milo
    Apr 2, 2014 at 1:57
  • 1
    You can use the attachment.php template to serve the files, so you never reveal the actual location to the end users and you can use that to lock down access as needed. Require log in and then give them the file from an obfuscated url. Of course the original file is still accessible, but they would have to know where to look. This doesn't require changing the file name. The only way to fully stop access to the actual file would be to use htaccess to redirect users to a gateway file.
    – Jake
    Apr 2, 2014 at 2:12


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.