Medifence – Access Control for Media Uploads
By default, every file inside the WordPress uploads directory can be opened by anyone who knows its URL. For membership sites this means that protected content pages are useless if the images inside them can still be opened directly.
Medifence puts a login check in front of every uploads request — without changing a single URL and without moving any files.
How it works
On activation, the plugin writes a small rule block into the .htaccess file inside your uploads directory (using WordPress’s own marker mechanism, so rules from other plugins are preserved). Requests for existing files are rewritten to WordPress itself, which bootstraps normally; the plugin then verifies the visitor is logged in and streams the file. No WordPress core file is ever loaded directly. Deactivating or uninstalling the plugin removes the rules, and your files are served normally again.
Features
- File URLs stay exactly the same — nothing to update in posts or the database
- Physical files stay where they are — no migration needed
- Built-in live verification: the settings screen requests a test file without a session cookie and shows the actual HTTP status anonymous visitors receive
- A warning appears on all admin screens if another plugin overwrites the rules
- Optionally require a specific capability in addition to being logged in
- Choose the denied status code (403, 404, or 401) — 404 hides that the file exists
- Or send visitors who open a protected file to the login screen, and back to the file afterwards
- Optionally serve a placeholder image instead of denied images
- Exclude specific file extensions (useful when your theme loads CSS or fonts from uploads)
- Exclude individual folders, or flip it around and protect only the folders you list — picked from the folders you actually have
- Or let each file follow the post it is attached to: published posts stay public, private ones require a login
- Make a single file an exception to all of that — always public, or always protected — from the media library
- Share a single protected file with someone who has no account, using an expiring signed link — and revoke any of them individually
- Limit a share link to a number of downloads, note down who it was issued to, and see how often it has been used
- A daily check restores the rules automatically if another plugin removes or overwrites them
- Optionally emails you when the protection stops working — once, when the verdict changes
- Reports the protection status in Site Health, and offers WP-CLI commands for deployments
- Inspect any single file to see whether it is reachable, and which setting decided it
- Audit the whole library in one click and get the list of files your settings leave public
- Optionally count what was blocked, per file — without storing IP addresses or user agents
- See at a glance which files are protected, from a column in the media library
- Range request support for video and audio seeking, ETag-based browser caching for logged-in users
- Cleans up completely on uninstall
Requirements
- Apache or LiteSpeed with mod_rewrite enabled
- A writable
.htaccessfile in the uploads directory
This plugin does not work on nginx, because nginx does not read .htaccess files. The built-in live test will tell you immediately whether your server is compatible.
For developers
The final access decision can be filtered:
add_filter( 'medifence_allow_access', function ( $allowed, $file_path ) {
// Example: always allow files inside uploads/public/.
if ( false !== strpos( $file_path, '/uploads/public/' ) ) {
return true;
}
return $allowed;
}, 10, 2 );