I was hoping it would be possible to save original images to a separate directory to the resized images so that they could be safely hidden but this seems to be too difficult.

So I am now asking if there are any ways of protecting original full-size images from public but still allow them to view the re-sized images.

I'm not talking about hiding/protecting images on screen, moreover ways of giving original images unguessable url's or some such scheme to stop them from possibly being downloaded.


uploads/my_image-200x200.jpg (given this url)

uploads/my_image.jpg (this url can be easily worked out)

  • Did you ever find a solution to this? It seems strange that with all the WP plugins out there, one of them doesn't help you keep original images 100% isolated (even from good guessers).
    – kobejohn
    Commented Feb 8, 2012 at 23:07

6 Answers 6


I was looking for a way to do this and found this page... then I thought of putting this in a .htaccess file in the WordPress uploads folder and it works for me so far... any good?

<FilesMatch "\.jpg$">
    order allow,deny
    deny from all

<FilesMatch "-[0-9]+x[0-9]+\.jpg$">
    order allow,deny
    allow from all

The first part denies access to all .jpg files and the second part searches for files with a size appended to the filename and allows access to those... you could also add directives for any other .jpg files that need to be viewable but all my other graphics are .png files so it's not a problem for me.


There's only one thing I know for sure - your images will be NEVER secure if you display their thumbnails based on the real URL.

But I have a few ideas, the first one looks great and should work for you. Mixing them together will make accessing your images much more harder.

Edit wp-includes\media.php file.

Line 435:

$suffix = "{$dst_w}x{$dst_h}";

$info = pathinfo($file);
$dir = $info['dirname'];
$ext = $info['extension'];
$name = wp_basename($file, ".$ext");

Playing with $suffix and $name could do the thing, give it a try.

Eg. changing $sufix to "something" will output thumbnail names as:


Still easy to guess, but what will happen when you add something before "my_image"? Something random + random jpgs names = seems pretty secure to me :)

Use TimThumb.

It creates thumbnails "on the fly", eg. you have www.domain.com/myimage.jpg and you want to display 200x200 thumbnail, so you just put timthumb.php wherever you want and then write something like:

<img src="timthumb.php?src=www.domain.com/myimage.jpg&h=200&w=200&zc=1" alt=""> 

It's not perfect but always harder than plain link, especially when it comes to bot image harvesting.

Use Watermark plugin.

Probably the most "secure" option, especially when you create thumbnails before adding watermarks to the full size images.

  • My problem with using TimThumb to generate the thumbnails is that I need the functionality of being able to crop the thumbnails myself. If I watermark the images, then want to regenerate thumbnails the watermark could show up (if it doesn't then surely the original image could still be got at by someone who could work out the url). If the original image could be given a different directory or prefix to the generated images they would be quite safe from prying eyes, I couldn't see how I could edit media.php to just affect the original image whilst leaving the resized ones with an unchanged url.
    – Andy
    Commented Apr 7, 2011 at 14:17

Why go through the trouble , it's possible but it requires jumping through all sorts of hoops and using more resources. You can use fopen , the database or nested php files, for instance have a look at php image protect class

Is this for people or bots?

  • 1
    It is for both people and bots I suppose. Mainly people though, I didn't want the original image to be viewable at the larger original size in case it is downloaded and printed. The other resized images are perfect for screen viewing but would produce poor quality prints. It's for a website gallery containing artwork.
    – Andy
    Commented Apr 7, 2011 at 14:01

Use the Next Gen Gallery plugin: Thumbnails are given different file names and galleries and posts can have many to many relationship. NextGEN Gallery

  • Thanks, I've used that on another website and while it is a useful plugin I'm not sure that it would fit in with the way I want the cms to work. Here I am using a custom post type, with each item having its own meta data/image/url (not a javascript url). The entire site is a gallery.
    – Andy
    Commented Apr 7, 2011 at 14:06

If you do not mind editing the Wordpress core I found a few places that might be worth a look.

Trolling through wp-admin/includes/media-upload.php lead me to media_handle_upload() (line #186) and image_resize() (line #405 of wp-includes/media.php).

media_handle_upload() deals with the media form submission.

image_resize() handles in the very least the name of a resized image (e.g. filename.jpg resized to filename-200x200.jpeg).

I also found wp_create_thumbnail() (line #23 of wp-includes/wp-admin/image.php) which has a filter of 'wp_create_thumbnail' called after the above mentioned image_resize() if you wanted to try to go the pluggable route.


Try this plugin that protects the image from "view image" http://wordpress.org/support/topic/great-plugin-to-protect-content-amp-images-of-your-blog


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.