1

I have installed Wordpress in a subdirectory of a subdomain. I am using the following rewrite rule to direct all urls to this subdirectory.

RewriteCond %{HTTP_HOST} ^(www\.)?mysubdomain.mydomain\.
RewriteRule ^(.*)$ /wp/$1 [L]

This is working fine! Now, I want to only allow logged in users to be able to access the 'wp-content/uploads/' folder. I am using the solution explained here: https://gist.github.com/hakre/1552239

I have added the following rewrite rule to my .htaccess (above the previous rewrite rule):

RewriteRule ^wp-content/uploads/(.*)$ dl-file.php?file=$1 [QSA,L]

This, however, only works for 50%. When I am logged in and I try to access an image with a path like '.../wp-contents/uploads/image.jpg', I get redirected to the log-in page. Just as how it should happen. However, since I installed Wordpress in a subdirectory, the image path actually is '.../wp/wp-contents/uploads/image.jpg'. When I am not logged in and try to access an image with this path, the image opens normally. I am not being redirected to the log-in page.

I have tried adding 'wp' to a rewrite rule, like:

RewriteRule ^wp/wp-content/uploads/(.*)$ dl-file.php?file=$1 [QSA,L] 

But to no success. I am sure I am missing something in my .htaccess file. Any ideas how to ensure that images are no longer accessible for non logged-in users would be much appreciated.

1
  • What other directives do you have in the root .htaccess file? Presumably you have another .htaccess file in the /wp subdirectory? Please include the contents of this .htaccess file also.
    – MrWhite
    Commented Jun 20, 2022 at 10:15

1 Answer 1

0
I have added the following rewrite rule to my .htaccess (above the previous rewrite rule):

RewriteRule ^wp-content/uploads/(.*)$ dl-file.php?file=$1 [QSA,L]

You presumably have another .htaccess file in the /wp subdirectory that contains the main WordPress directives (ie. # BEGIN WordPress etc.).

You should be adding the above rule to the /wp/.htaccess file, not the one in the root.

When accessing a URL of the form /wp/... the mod_rewrite directives in the root .htaccess file are completely overridden by the mod_rewrite directives in /wp/.htaccess (by default). The mod_rewrite directives in the root .htaccess file are not even processed, since mod_rewrite directives are not inherited by default.

The dl-file.php script should then be in the root of the WordPress installation, not in the document root.


Aside:

However, since I installed Wordpress in a subdirectory, the image path actually is .../wp/wp-contents/uploads/image.jpg.

Although this would imply you have a mismatch of URLs... some containing the /wp subdirectory and some (your static assets) not.

The first rule you posted rewrites requests to the /wp subdirectory for any request where it is omitted. (The .htaccess file in the /wp subdirectory ensures it does not rewrite requests that already contain /wp.)

You should either:

  • Include /wp in all your URLs

  • Omit /wp from all your URLs.

You currently appear to have a mixture of both.

2
  • Thanks. I was applying all rewrite rules to the htaccess in root folder. Putting it in the wordpress directory worked like a charme. Sometimes it can be so easy... Regarding your second remark: all urls contain '/wp', there is no mixture with/without '/wp'. while testing I noticed the dl-file.php only worked when leaving out '/wp', but when included, it didn't. Should have made this more clear.
    – jc100
    Commented Jun 20, 2022 at 12:12
  • @jc100 You're welcome. When accessing a URL of the form /wp/... then the mod_rewrite directives in the root .htaccess file are completely overridden (by default). "all urls contain '/wp'" - in that case, your initial rule that "direct(s) all urls to this subdirectory" is not required? (If anything, this should instead be a "redirect", not an internal "rewrite".)
    – MrWhite
    Commented Jun 20, 2022 at 12:54

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.