How can I restrict only the PDF files that I uploaded through FTP, I copied the link of each PDF file and created buttons in WooCommerce, I can Restrict the Page/Post but not the PDF. I want users to login to be able to view the PDF files. I would appreciate the support.


You cannot restrict users from downloading a file from a path using a wordpress login for various reasons, the most important is that the WP login is handled by PHP while the download is handled via Apache.

That said, there is a way to achieve the result of what you're after. What you need to do is write a custom download handler for your PDFs. There are various ways to do this, but they will resemble something like this.

function downloadPDF(){
        //do your user isn't logged in logic here
        $path = WP_CONTENT_DIR . '/path/to/pdf'; //The path to the pdf file that you want to access.
        if(file_exists($path)){ //check to make sure the file exists
            header('Content-Description: File Transfer');
            header('Content-Type: application/pdf');
            header('Content-Disposition: attachment; filename="'.end(explode('/',$path).'"');
            header('Content-Transfer-Encoding: binary');
            header('Expires: 0');
            header('Cache-Control: must-revalidate, post-check=0, pre-check=0');
            header('Pragma: public');
            header('Content-Length: ' . filesize($path));
            //do your invalid file logic here


What is happening here is, it checks to see if a user is logged in. If so, it checks to see if a file exists and if it does serve it for download.

Note, this is an extremely basic skeleton of what you need to do. You will need to make this function fire when someone attempts to download a pdf (possibly with an .htaccess rule + action hook, but there are other ways).

| improve this answer | |
  • Since the URL that a user accesses mustn't exist (otherwise they'd just get straight to the file) then there shouldn't be any need to change .htaccess. The standard WP rules will pass the unrecognised URL to WP in the usual way. – Andy Macaulay-Brook Aug 12 '16 at 16:31
  • 1
    I'm saying he could have a rule that redirects all *.pdf urls to his handler. – TheGentleman Aug 12 '16 at 16:43
  • Yeh, agreed, it wasn't a complaint and I voted up the answer :-) I was thinking that if you don't have to fiddle with .htaccess it makes your code a bit more self-contained, but then I guess you need to make sure your source PDFs are outside the doc root. – Andy Macaulay-Brook Aug 12 '16 at 16:49
  • Thank you for your help, I don't want the user to directly download, instead to View the PDF file, on both ways he'll be able to download it if he opens the PDF in browser. Can I use your script to do that? – Ashraf Aug 12 '16 at 17:51
  • The "View In Browser" thing is generally a browser specific setting. The script as written should respect whatever the browser usually does with PDFs. If you want to force viewing of a PDF regardless of browser you'll have to use something like github.com/mozilla/pdf.js. – TheGentleman Aug 12 '16 at 17:55

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.