I just found out tha I have a wp-content directory that is open where you can see all of my files that I have on mysite- pdf's, jpgs, etc. Files that are meant to be for members only as well....all images uploaded etc. I was wondering if: a) Is there is any way to tell if anyone has been there and if they have downloaded any of my files? b) how do I close this directory?

Thank you!


A) The best you can do is look through server logs, if you have access to them. You would have to comb through the logs and you can then find what IP addresses have requested certain files. If any are from human visitors then yes, their web browser has downloaded the file to a cache. Most users aren't savvy enough to comb through their cache to save images but it is possible.

B) There are several steps to secure the folder.

Step 1: add a .htaccess file right in the /wp-content/ folder. All it needs to contain is

Options -Indexes

That way if someone visits http://example.com/wp-content/ they will not see a list of files to peruse. The file applies to this folder and any subfolders so you're covered from that angle.

Step 2: discourage search engines from indexing images. Edit your existing, or create a new, robots.txt in your root folder so it is available at http://example.com/robots.txt:

User-agent: Googlebot-Image
Disallow: /wp-content/

This will tell Google not to show any of the files in search results. You may also want to block other search engines - you'll just add multiple user-agents with the same rule.

Step 3: You should look into other membership plugins as ideally the membership plugin should control access to the files themselves. There are various methods to make the files only available through your server, such as actually moving the content to a folder outside the public html folder and then serving it via PHP, and it really depends on your plugin setup which method will work best, but it's simplest if the member plugin itself handles this part for you.

  • Thank you so much for all this! So to confirm - I can get my website company to go through my server logs & then they could find out what IP addresses downloaded certain files? If they did & were humans- we could then find an IP address & find out who downloaded what? Can you clarify what the part about the cashe for me, please? Do you mean myself the website owner or the person who might have downloaded my files- sorry I'm not tech inclined & am trying to navigate this as best as I can to try & understand how this works! So if the person who downloaded my file .... – ella Oct 31 '18 at 14:58
  • deleted their cache- we wouldn't be able to find them? Is that what you mean? Thanks SO much for the recommendations -I will look into all them now! – ella Oct 31 '18 at 14:58
  • You can ask your host about the logs, but most hosts do not provide that level of service. You will probably have to look through the logs yourself, but yes, you can see lots of which IP addresses requested which files. Some will be clear like Googlebot but most will not be clear whether they are bots or humans. Requesting a file does not make it clear whether or not the person knows how to easily access that file again later, but technically it stays on their computer until they clear their browser's cache. Them clearing their cache will not remove them from your logs. – WebElaine Oct 31 '18 at 15:23
  • By cache in this case I mean the visitor's browser saving all the files they have accessed. This is normal behavior - say you visit a website and it has a logo in the header. When you go to another page on that website, your browser already has that logo downloaded to its cache so it can display immediately, instead of having to request another copy of it with each page you visit. There are also such things as caches on your actual web server but that part isn't relevant to your concerns here. – WebElaine Oct 31 '18 at 15:25

Make sure there is an index.php file in the wp-content directory that has the following code in it:

// Silence is golden.

That should fix your problem.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.