How to mask external download links to be only accessible by logged-in users?

Like the direct download link example: www.example.com/direct-download-link1

We want to mask it like: www.ourwebsite.com/direct-download-link1

and this above link should only be accessible by logged-in members.

How to do?

  • let me understand this better, You want to check whether current user is logged in to change displaying URL, am I right? – Vishwa May 9 at 5:09
  • not changing the displaying of URL but they shouldnt get access when they copy outside of wp and paste into their browser url bar. So it may be something like a redirect url but only for logged in members – maxwassim May 9 at 5:50
  • IMO, if someone has the direct link (Ex: website.com/file.jpg), then they can share it outside, and others can have access to file directly. to avoid that, you can add session to the download link at the download site. or add ip filter (should be the same ip that logged in user clicked on), but to do that, you have to pass users ip value to download server – Vishwa May 9 at 5:54
  • yes but the easy way is just mirroring external link structure – maxwassim May 9 at 17:18

I will make an assumption, based on your question:

You care how your link is output by the back-end and a JS-based solution is not good, since it defeats the assumed security.

My suggestion? Instead of doing checks virtually everywhere in your codebase where there's an output link, in your set-up, as early as possible after the user has logged in, do:

$user = wp_get_current_user();
if( $user->exists ) {
    add_filter( 'public_link_root', function() { return 'example.com'; } );

Whenever you have to output a link, instead of doing that check over and over, because it's already established that the user's logged in, if you wrote your system in the correct manner (and you can do additional checks), do:

$link_to_output = apply_filters( 'public_link_root', 'ourwebsite.com' ) . '/resources/whatever/here';

Don't forget to esc_url whenever you output the link, you can wrap all this in a function if you want.

  • what if we only add_filter for specific external root domain like there are example1.com, example2.com etc. and can we implement s2member level too? and plus people still see the external link when downloading..? – maxwassim May 8 at 20:18
  • @maxwassim I'm not sure what to answer. Are you a developer? If not, this isn't helpful to you, if you're using a plugin, ask the plugin makers. – coolpasta May 8 at 20:21
  • i just dont understand this part: $link_to_output = apply_filters( 'public_link_root', 'ourwebsite.com' ) . '/resources/whatever/here'; ?? – maxwassim May 8 at 20:34

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.