I am trying to set up a multisite intranet (using subdomains) where content on each sub-site is only accessible to users logged into their respective site. The problem I am having is trying to restrict access to uploaded files (e.g. http://example.org/wp-content/uploads/2011/12/dummy.pdf) to logged in users only.

Similar to How to Protect Uploads, if User is not Logged In?, how would I enable one of the solutions proposed by hakre or Frank Bueltge for a multisite installation?

I have been scouring the net and Wordress Answers but haven’t managed to find something that I can get to work. Related answers are:

Also, I am new to PHP and still learning how WordPress works under the hood, so detailed information about what I need to do and what goes where would be much appreciated.


  • I'm not sure why this Question was closed as exact duplicate. The suspected one doesn't covers Multisite. – brasofilo Nov 25 '12 at 14:20
  • 1
    @brasofilo I re-opened it now. – fuxia Nov 25 '12 at 16:18

Nice Question!

Poking around it a little bit, this seems to be working (further tests and a more qualified look are much welcome:). Tested only in a localhost development install with subdomains. No domain mapping.

Change the following .htaccess rewrite rule:

# uploaded files
# RewriteRule ^files/(.+) wp-includes/ms-files.php?file=$1 [L]
RewriteRule ^files/(.+) dl-files.php?file=$1 [L]

Make a copy of /wp-includes/ms-files.php and place it on the root with the name dl-files.php.

Disable SHORTINIT, modify the wp-load.php path and add a current_user_can() check at the very beginning, so it becomes:

 * Modified Multisite upload handler.
 * @since 3.0.0
 * @package WordPress
 * @subpackage Multisite

//define( 'SHORTINIT', true );
require_once( 'wp-load.php' );

if( !is_multisite() )
    die( 'Multisite support not enabled' );

if( !current_user_can( 'subscriber' ) ) {
    status_header( 403 );
    die( '403 &#8212; Forbidden.' );


/* ... rest of the original file ... */

Note that removing the SHORTINIT increases loading time and memory consumption. Read somewhere that it could be a ten fold increase (!?).

Interesting discussions in wp-edu list (haven't found nothing in wp-hackers):

| improve this answer | |
  • Thanks so much for your answer. I have actually put this project on hold for now as I didn't manage to find a good solution (late Aug) when I first posted my question. Hopefully, someone else will find your solution useful. Much appreciated! – acdesigns Nov 16 '12 at 2:48

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.