My company has an internal sales site and they use the OneLogin SAML SSO plugin for authentication. The site is not supposed to be viewable to the general public. Apparently they only checked the WP 'Discourage search engines...' and did not put X-Robots or any other methods of preventing search engine results in place.

So a PDF got indexed by Google and is returning the sales site URL in the SERPs. Strike 1. Not only that, the OneLogin plugin apparently only protects pages and posts--hitting the PDF or other media files directly allows anyone to view them. Strike 2.

Is there any way of password protecting the media library files only (since the pages and posts are already protected)?

1 Answer 1


You could check for a log-in cookie in your .htaccess, but that can be spoofed:

RewriteCond %{HTTP_COOKIE} ! wordpress_logged_in_.+= [NC]
RewriteRule \.pdf$ - [F,L]

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.