I am trying to protect the uploads directory with .htacess.

But when I browse media section in admin panel, I see user/pass popup.
My guess is, WordPress use fopen to find if the file exists. I found mod_rewrite rule allowing fopen but I can't figure out how to use those rules with basic HTTP authentication. Any help is highly appreciated.

following is the rewrite rules for allowing fopen:

RewriteEngine On  
RewriteBase /

RewriteCond %{THE_REQUEST} ^.+$ [NC]  
RewriteRule .* - [F,L]
# Only allow access to this directory if they are coming from your domain; excluding you, your server, Google and any other IPs
RewriteEngine On
RewriteCond %{REMOTE_ADDR} !^(xxx\.xxx\.xxx\.xxx|xxx\.xxx\xxx\.xxx|66\.249\.)
RewriteCond %{HTTP_HOST} !^(127\.0\.0\.0|localhost) [NC]
RewriteCond %{HTTP_REFERER} !^https?://(.+\.)?yourdomain\.com/ [NC]
RewriteRule .* http://yourdomain.com/ [L]

That should help, I think

  • Thanks. but i have an .htpasswd file there too. i want to be able to allow users who have password. these rules don't seemed to do that. is there any way ?? – nur May 6 '12 at 19:34
  • 1
    Well, I think the user must enter the password manually each time if you use a .htpasswd file, but no idea, the example above will give access to users that are looged in (since these folders will require that by default on wordpress). and provided that they access the folder by following internal links within your site. Honestly I can't think on something better. (not an expert) – user983248 May 6 '12 at 22:38

See this popular answer, it works and is easy to use. You find the source als oin a Gist.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.