I'm developing a simple "member's only" section within a website, with the sole intention of allowing the client to post files for their members. I've come to realize quickly that the posts' attachments themselves are not protected in any way within WordPress. For example, if a user was not logged in and if they knew the direct url to the file, they could access it/share it with others. This is a big problem as the documents are rather sensitive to the client' business.

The member's area is being built using all the tools you'd expect - a custom page template paired with current_user_can conditionals, wp_redirects, custom roles using the members plugin, and a custom post type for the "file" posts. Each file post within the custom post type has metaboxes that the client can use to attach files/documents (.jpg, .gif, .pdf to name a few). I'm using WPAlchemy and it's Media Access class to satisfy the metabox requirements.

The member's area will be running on 1 particular site within a multisite installation, which comprises of 3 sites in total (all related to the same company).

I'd be very grateful if someone could steer me in the right direction. I'd prefer not to have to use an array of plugins, as I like to keep things simple and like to know what the code is actually doing. I also realize that this may not necessarily be a WordPress question, and more of a .htaccess question (as I've seen from the questions I've come across and their answers), but I can't help thinking that my question is different in that it relates to multisite, and the possible need for a separate upload folder.

Here are my thoughts so far on protecting the attachments:

  1. I could somehow create a separate media upload directory that the metaboxes upload the files to from each post within the custom post type. Because these files are separated from the rest of the sites' media uploads (only the member's attachments need to be protected) It would make it easier to protect just that folder using .htaccess.

    1.1. Is some sort of .htaccess modification definately the way to go here?

    1.2. How could I actually create the separate media upload directory, and have WPAlchemy's metaboxes upload the files here? I've seen a uploads_dir filter hook but not sure on how to use it.

  2. Rather than creating a separate media upload directory as outlined above, maybe the better solution would be to only protect the attachments belonging to my custom post type? But then I have no idea how that ties in with the .htaccess solution. It seems like having a separate folder would be easier...

I've seen the following questions that are very similar to my own:

  1. How to Protect Uploads, if user is not Logged In?

    Look like it deals with a non-multisite installation of WP, and also the whole site is a member area vs a section of my site. Remember, I don't want all uploads to be protected, just the ones attached to the custom post type. I do like the idea of passing requests through a php script? Perhaps I could use this script and modify it to use a separate upload directory on the 1 site within my multisite installation?

  2. Protect Uploads in Multisite


  3. How to restrict access to uploaded files?


Found this thread but no solution to it. Seems like the better way to go if I can get it working. I'll work out how to upload the files to a new uploads directory after I've managed to protect all of the site's files

  • Is this custom post type also available on other sub-sites in your multi-site installation or is it only available on the one sub-site you mention?
    – Adam
    Apr 27, 2012 at 7:02
  • @userabuser The custom post type is just on that one site
    – Andrew
    Apr 27, 2012 at 8:18

1 Answer 1



In the case where your custom post type exists on only one sub-site of your Multi Site installation, you can in your template file in which controls the display and output of your custom post type work with simple conditional functions such as;

  • is_singular('post_type_name');
  • is_user_logged_in();

...and in-fact it might well be as simple as;

<?php if(is_user_logged_in()) : ?>

<?php echo wp_get_attachment_url( 12 );?>

<?php else : ?>

//Do what you want here, such as nothing or redirect to login page or alert user that some content is hidden etc.

<?php endif;?>

Hopefully this is along the lines of what you are looking for. If its not as simple as that for solution let me know and we'll dig deeper.

PS. Replace wp_get_attachment_url() with whatever suits your purpose;

  • wp_get_attachment_metadata()
  • wp_read_image_metadata()
  • wp_get_attachment_image()
  • wp_get_attachment_image_src()
  • wp_get_attachment_thumb_file()
  • wp_get_attachment_thumb_url()
  • wp_get_attachment_link()
  • wp_get_attachment_url()

@Codex... HERE


Or... in the case of using WPAlchemy you would replace the above wp_get_attachment... etc with your custom metabox code instead.

<?php custom_metabox->the_field('name'); ?>
  • Appreciate the answer. That would hide the attachments from displaying on the page, but it wouldn't protect the attachments if you knew the URL to the attachment. Imagine an image or PDF within the member's area. Someone could just type the URL to the file straight into their browser's address bar, and download it straight away. I already have made use of is_user_logged_in to protect the entire member's area (so I wouldn't really need to use the code above to hide the attachments again).
    – Andrew
    Apr 27, 2012 at 22:04
  • @Andrew Have you then tried wrapping the script found HERE in a conditional if(is_singular('post_type_name')) tag? Which will check for the existence of the post type first before running the rest of the script.
    – Adam
    Apr 28, 2012 at 0:29
  • I'm trying to get the script going but having no luck, a var_dump on the $file variable returns NULL. Do you think that script needs to be modified in some way for multisite? The uploads directories are different.
    – Andrew
    Apr 28, 2012 at 4:04
  • The script would need modifying yes. Take a look @ the following links for some insight: HERE and HERE and HERE (for some of the CONSTANTS related to a Multi Site install). I haven't had the opportunity to dig deeper. But you definitely need to get the directy situation sorted out first. Possibly try working with an absolute path reference to see if you can first get the script to work.
    – Adam
    Apr 28, 2012 at 4:52

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.