RB Cloak Media Files protects your WordPress media library by replacing real filenames with cryptographically secure cloaks. This prevents unauthorised users from discovering your private files through URL guessing, brute‑forcing, or enumeration attacks.
If your website contains sensitive, private, or paid content (course materials, client documents, downloadable assets, membership content, or internal resources), your media folder may be more exposed than you think. WordPress stores every uploaded file under a predictable path (/uploads/yyyy/mm/filename.ext). Anyone who knows or guesses a filename can access it directly, even without a user account.
RB Cloak Media Files solves this by giving every protected file a unique, unpredictable identifier that cannot be enumerated. The original filename is stored safely in post meta, so you never lose track of your data.
Who is this plugin for?
- Membership, LMS, and course creators who deliver paid digital content.
- Agencies and professionals who store private client files in WordPress.
- Creators selling digital downloads, templates, assets, or media packs.
- Internal or intranet sites that must prevent casual file discovery.
- Any website that wants stronger media security without complex setups.
What problem does RB Cloak Media Files solve?
WordPress never checks permissions when serving files directly from /uploads/.
Anyone with the URL can access the file, even if the content is:
* behind a paywall
* visible only to logged‑in users
* restricted to specific roles
* attached to private or draft posts
RB Cloak Media Files prevents this by replacing the original filenames with secure cloaks, making URLs impossible to guess. This dramatically reduces the risk of:
- URL enumeration
- brute‑forced filename discovery
- leaking sensitive client files
- unauthorised downloads
- scraping or hotlinking
Key Features
- Automatically cloak new uploads with secure random filenames.
- Manually cloak, re‑cloak, or uncloak files from the Media Library.
- Optional original‑name prefix for SEO‑friendly cloaks (e.g.,
image-xxxxx.jpg). - Configurable cloak length (short, medium, or long).
- Optional Unix timestamp for guaranteed uniqueness.
- Inline status badges in the Media Library.
- Filter by cloak status (Cloaked / Uncloaked / Pending).
- Dashboard with live statistics.
- Works with core WordPress functions (
wp_get_attachment_url(),the_post_thumbnail(), etc.).
RB Cloak Media Files is lightweight, fast, and designed to work seamlessly with any theme or plugin. No complex setup: activate and your new uploads are protected immediately.