I'm developing a website for a large corporation. They release financial documents on specific dates and times. I've developed a custom form to upload these pdfs to articles, and custom loops that display only these attachments on specific pages. When the date of the article is set in the future, the attachments are released when they should and the system works pretty well.

The only thing is, that for the company it's super-important that there is no access to the attachment-files before the date when it's supposed to come out. So if anyone can guess the name of the attachment they can just go to wp-content/uploads/financialdocument10.pdf and read it before it's supposed to come out.

Is there any ideas how to prevent this? My only idea so far is to add some random characters to the file name so it's impossible to deduce it's name on the the basis of previous filenames.



WordPress is engineered exclusively to reside in web-accessible folders, unlike many less user-centric web frameworks, which separate locations of private (code, etc) and public (assets).

Making filenames hard to guess is about as good as it gets with normal workflow.

To have this really tight you would need completely custom workflow with files places into web-inaccessible directory and moved to public ones at the release time.

| improve this answer | |

The easiest solution is to not publish critical information in the future. When you need to follow some regulations or contracts then you don't want to depend upon wordpress or your server stack to not have any bugs which will disclose the info too early or too late. Wordpress is a great software but it is just not good enough (and same goes for the server software on which it runs) when the cost of failure of a simple bug can be measured in millions.

Best way to avoid data leaking to the internet is to not have it accessible on the internet until it is the time to make it public knowledge.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.