I have this function which puts files in a /uploads/ subdirectory based on their user ID (for example, user with ID 23 uploads image.jpeg, it ends up here: /wp-content/uploads/23/image.jpeg ) and it works fine:

function sf_per_user_upload_dir( $original ){

    $modified = $original;

    if ( is_user_logged_in() ) {

        $subdir = get_current_user_id();
        $modified['subdir'] = $subdir;
        $modified['url'] = $original['baseurl'] . '/' . $subdir;
        $modified['path'] = $original['basedir'] . DIRECTORY_SEPARATOR . $subdir;


    return $modified;

add_filter( 'upload_dir', 'sf_per_user_upload_dir');

How would I go about extending this to only allow users to download files from their own sub-directory? As an example, so user with ID 23 can access /wp-content/uploads/23/image.jpeg, but can't access /wp-content/uploads/64/image-2.jpeg?

  • since the file is on-disk and anyone with a web browser can access these files, there's nothing to stop anyone, WP user or not, from accessing these images that are present on the site. If you take a look at the default .htaccess for a WP site, you'll see that if the request is to a file that exists, it doesn't load through WordPress' index.php. What you'll need to do is upload and mask it somehow so you use virtual paths and rewrite rules to access the images. You wont be able to do it in the matter you're currently looking to do so – Paul G. Jun 15 '19 at 22:08

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.