Hey. I need to prevent direct access to http://www.site.com/wp-content/uploads/folder/something.pdf through the browser. However the

Question

Asked: May 15, 20262026-05-15T01:24:40+00:00 2026-05-15T01:24:40+00:00

Hey. I need to prevent direct access to http://www.site.com/wp-content/uploads/folder/something.pdf through the browser.

However the Download Monitor plugin I am using, which allows logged in users to download the file, needs to be able to work.

Trying

but the download links do not now work… even though (I think) they are links produced by the script e.g.

Enter that in the address bar and you correctly get a WordPress message, ‘You must be logged in to download this file.’

However, if someone knows the URL where the file was uploaded

they can still access it directly.

I don’t know how (guesswork?) they would find the direct URL anyway, but the client wants it stopped!

Thanks for any help.

You must login to add an answer.

Need An Account,

Editorial Team · Answer 1 · 2026-05-15T01:24:40+00:00

Editorial Team

You cannot set Deny in .htaccess because your WordPress and a standard file request has the same server user – www-data/apache/http/or something.

You can for example sat folder’s chmod to 700 and it will allow access for script but not for direct file call.

And accept your recent questions.

The Archive Base Latest Questions