Background of my problem: I'd like to mask external download links as internal links and to be only accessible by logged-in wp users at htaccess level or with PHP script but when redirection happens the visitor outside of wordpress can still access download links by pasting direct url into browser bar.

I've tried this code for redirection to external link.

Redirect 301 /resources https://external.com/direct-download-link1

Before accessing that direct download link (ourwebsite.com/resources) a script must be like man in the middle and check if the visitor is logged into wordpress.

I'd like to change where the redirect goes have it go to a PHP page where you may load WordPress and check the role of the user to make sure they are logged in.

require('../wp-load.php');  // modify to reflect where your PHP file is in relation to Wordpress
$roles = wp_get_current_user()->roles;  // get current users role

if (!in_array('alloweduserrole',$roles)) {  // modify to match your roles that are allowed to download

    header('Location: http://www.ourwebsite.com/');

}  // end of if user does not have the proper role

The above code can be developed with a simple php checking script. But don't know how to implement and which code to change.

  • If your site is www.example.com, your htaccess rule can't specify a redirect for a request for www.anotherdomain.com . If there is a link in your example.com site for anotherdomain.com site, clicking on that link will not perform any request to your example.com site. The visitor will 'leave the building' and you can't do anything about what they do when they click that link. – Rick Hellewell May 14 '19 at 18:00
  • Are you trying to stop someone typing https://external.com/direct-download-link1 into the browser and successfully downloading, or trying to stop someone typing your redirect URL into the browser and being redirected? – Andrew Leach May 14 '19 at 22:00
  • @AndrewLeach trying to stop both if they are not logged into wordpress. – diladadufe May 16 '19 at 6:22

You can't "redirect" to the external site in .htaccess - there is no way for your script to do the "MITM" bit to check their credentials.

Instead, you would need to internally rewrite the request to your PHP script (in .htaccess). Your PHP script then checks that the user is logged in, etc. as you are doing and then your PHP script issues the appropriate redirect - in the same way your script is currently redirecting back to your own site when authentication fails (although arguably that should be a 403 instead).

For example, before the WordPress front-controller:

RewriteEngine On

RewriteRule ^resources$ /php-authentication-script.php [L]

The above will internally rewrite any request for /resources to your /php-authentication-script.php. The URL in the browsers address bar remains as /resources, until your PHP script issues the redirect.

  • No this code redirects to external site: Redirect 301 /resources external.com/direct-download-link1 what code should i add to this php file: ? php-authentication-script.php ? – diladadufe May 16 '19 at 6:23
  • can i use redirect and rewrite rule together? – diladadufe May 16 '19 at 6:28
  • @diladadufe You need to remove the Redirect directive. As I mentioned in my answer, if you "externally redirect" in .htaccess there is no way to then intercept that "redirect". You should instead rewrite the request to your script (using code like you posted in your question) that authenticates the user and issues a redirect. – MrWhite May 16 '19 at 14:12
  • As a general rule, you should not use redirects using both mod_alias Redirect and mod_rewrite RewriteRule together in the same context (if that is what you are referring to). Different Apache modules execute at different times during the request - not necessarily in the order the directives appear in your .htaccess file - so you can get unexpected conflicts. – MrWhite May 16 '19 at 14:15
  • can u also write the proper code for php-authentication-script.php ? – diladadufe May 17 '19 at 16:33

The way I do this is to use .htaccess to check for the existence of WordPress's logged-in cookie and redirect requests which do not have it to a particular page. The .htaccess file should go within your /resources directory so it only applies to that folder and any subfolders. This is the relevant part:

Options -Indexes
RewriteEngine On
RewriteCond %{HTTP_COOKIE} !wordpress_logged_in_xxxxxxxxxx=
RewriteRule .* https://example.com/members-information [L]

This will redirect any requests which it handles (requests to /resources or destinations within /resources which don't include the cookie) somewhere else: in my case it goes to my members-information page which contains details of how to join.

Note that xxxx changes for each installation: you'll need to examine your cookies to find out which value your site uses.

Note too that this is as secure as I need it to be! While cookies should be exchanged only with the site to which they're associated, they can be spoofed.

This will cater for requests which attempt to reach /resources.

You can do nothing about people who type the external address into their browser: you don't control requests to that domain. You can't stop me typing wordpress.stackexhange.com into my browser or intercept requests which go there. The only way this can happen is with the co-operation of the external site owner who can incorporate checks on the referrer passed with the GET request to check that the request comes via your site — it could only come via your site if they are logged into your site and can see the link — but again the HTTP_REFERER header can be spoofed.

  • actually downloads are handled on different server and not in the wp site , its perl based download script and /resources path redirects to the external.com/directdownload- url – diladadufe May 16 '19 at 7:24
  • your assume was downloading occurs in wp end but its not its on external site's script end which i control of it too – diladadufe May 16 '19 at 7:27
  • No, I didn't assume that. I assumed downloading occurs on a different server from your WordPress site, because of your use of external.com. This .htaccess file goes on your WP site and controls access to that, so the download link is only visible to logged-in users. You can't control access to the external site (except the access via your WP site). – Andrew Leach May 16 '19 at 7:41
  • If you do control external.com as well than you can check the referer header. – Andrew Leach May 16 '19 at 7:42
  • where can i find the true value to add for xxxxxxxxxx ? and i have this code : Redirect 301 /resources external.com/direct-download-link1 in my public-html/ ht access folder if i add your htaccess into resources/ folder then it won't take effect, right? – diladadufe May 16 '19 at 8:07

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.