A site I'm working on has two security-related requirements which I've been unsuccessful in solving simultaneously. I can satisfy each requirement BY ITSELF, but I'm running into problems satisfying BOTH REQUIREMENTS at the same time.

  1. Requirement #1: Force SSL site-wide.
  2. Requirement #2 Disallow direct access to PDF, text, and image files in the /wp-content/uploads/ directory (or child directories).

To address requirement #1, I installed the SSL certificate on the site and made the standard changes in the WordPress dashboard (by adding the "s" in the WordPress Address and Site Address fields in General Settings). I also added the following to the root .htaccess file, above the WordPress section of directives:

RewriteEngine On
RewriteBase /
#RewriteCond %{SERVER_PORT} 80
#RewriteRule ^(.*)$ https://subdomain.example.com/$1 [R,L]

To address requirement #2, I added the following to the .htaccess file in the /wp-content/uploads/ directory:

Options -Indexes
RewriteEngine on 
RewriteCond %{HTTP_REFERER} !^http://(www\.)?subdomain\.example\.com [NC] 
RewriteCond %{HTTP_REFERER} !^http://(www\.)?subdomain\.example\.com.*$ [NC] 
RewriteRule \.(pdf|jpg|png|gif|txt)$ - [F]


Two problems exist:

  • I get 403 (forbidden) error when I click on links to files in the /wp-content/uploads/ directory.
  • Some embedded images do not display.

Can anyone suggest remedies? Thank you.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.