My company has an internal sales site and they use the OneLogin SAML SSO plugin for authentication. The site is not supposed to be viewable to the general public. Apparently they only checked the WP 'Discourage search engines...' and did not put X-Robots or any other methods of preventing search engine results in place.
So a PDF got indexed by Google and is returning the sales site URL in the SERPs. Strike 1. Not only that, the OneLogin plugin apparently only protects pages and posts--hitting the PDF or other media files directly allows anyone to view them. Strike 2.
Is there any way of password protecting the media library files only (since the pages and posts are already protected)?