I have locked the certain post page by the plugin.But the content which is stored in /upload/ file can be still accessed by anyone if he konw the url(like http://domain/wp-content/uploads/2020/02/01.jpg)

Now I have a PHP var to distinguish whether the user can access the content,how can I load PHP file to check before every request.It is like anti-hotlink but more strict,modifying .htaccess can check the referer,but seems like the referer can be forged.

I am using php7.3+nginx by the way.

I am freshman,I don't even konw whether it is right to achieve this,so if there are some better sollution please tell me.

  • excactly what I want,searching for this so hard with all of my key words.Thank you! – yu man Feb 15 at 12:01