I'm creating a plugin where user can download files. Currently I display download links like:

<a href="plugin/directory/some/path/download.php?file_to_download_id=1">Some Download</a>


I need to use wordpress core functionality like is_user_logged_in() or get_current_user_id() in the download.php . How am I able to use these functions in this php file?

(PS: I do not want to include wp-load in download.php)

  • Do let me know where is your downloads.php file located Is it inside the plugins folder? Nov 14 '17 at 7:04
  • Yes. It's located in the 'public' folder of my plugin folder.
    – QuickSort
    Nov 14 '17 at 7:05

You should create a function in your plugin where you listen to a specific URL or watch for specific parameters. For example to generate the download link:

    $nonce = wp_create_nonce( 'download-' . $filename );
    echo '<a href="/?_wp_nonce="' . $nonce . '&download=' . $filename . '">Some Download</a>';

And to download the file:

if ( ! empty( $_GET['_wp_nonce'] ) && ! empty( $_GET['download'] ) && wp_verify_nonce( $_GET['_wp_nonce'], 'download-' . $_GET['download'] ) ) {
     * Check if file exists and then output the right headers and the content of the file

  • 1
    This is not a proper answer, it doesn't help the user to do what he needs to do. Nov 14 '17 at 8:12
  • @Robin, you should add that this "if code" must be in a hook and then the asker can use directly this code.
    – mmm
    Nov 14 '17 at 8:20
  • I know how to generate the download link. I think the problem is the access to the download.php over the <a href=""> tag which does "exclude" the wordpress environment. At least all the functions mentioned above are undefined in download.php
    – QuickSort
    Nov 14 '17 at 10:33
  • It's not recommended to make a direct link to a file of a plugin. The code of Robin must be called in the action wp_loaded e.g.
    – mmm
    Nov 14 '17 at 11:35
  • @mmm thank you, I got it - finally. But is there no better way to achieve that? Now the execution of the download depends on the parameters - so the if statement has to be executed each time on wp_loaded to check whether the params are set or not.
    – QuickSort
    Nov 14 '17 at 12:23

WordPress provides a couple cookies that track whether the user is logged in and what their user ID is. These are described on this page in the Codex:

After login, wordpress sets the wordpress_logged_in_[hash] cookie, which indicates when you're logged in, and who you are, for most interface use.

WordPress also sets a few wp-settings-{time}-[UID] cookies. The number on the end is your individual user ID from the users database table. This is used to customize your view of admin interface, and possibly also the main site interface.

If you absolutely must avoid loading wp-load.php in your download.php file, you could check for the existence of these cookies in your file using the $_COOKIE global and parse the wp-settings-{time}-[UID] cookie to get the user ID ("UID").

In my honest opinion, I think this is a waste compared to just including the following two lines at the top of your download.php file:

define( 'WP_USE_THEMES', false );
require( './wp-load.php' ); 

This won't load any theme files or template functions, but will instantly give you access to the core WordPress functions you are looking for. I would encourage you to try it both ways (if you are so inclined) and see the performance difference... it won't be much, especially on a server running PHP7.

  • First of all - thanks for answering. Why I do not want to include the wp-load? It is not a performance issue it is just not recommended and considered as bad practice. To go the way with cookies would be possible, but isn't clean neither. What I did: I created the "download function" not in download.php but inside the main plugin files (with validation stuff using wordpress functionality) and added it to wp_loaded. The function is executed if the right parameters are set. It works fine - but there is still the issue that the parameter check has to be done each time wp_loaded is "fired".
    – QuickSort
    Nov 15 '17 at 16:17

As you have mentioned the file is located in your plugins folder you do not need to add the wp-load.php file here in case if you are not able to use the default WordPress functions. You need to include the file from your plugin's main PHP file.

Hope this solves your query.

  • No that did not help. It's still not possible to use that wordpress-core functions.
    – QuickSort
    Nov 14 '17 at 8:11
  • I downvoted because it's not recommended to make a direct link to a file of a plugin
    – mmm
    Nov 14 '17 at 8:19
  • I have just told him to include the file in plugins main php file hence there will not be any direct access to file @mmm Nov 14 '17 at 8:23

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.