Prevent Direct URL Access
This solution will prevent direct URL access to the files in your list on Apache web servers, which are most.
NOTE - On Apache web servers, Simple File List will do this automatically for you whenever you restrict access to a list.
Locking Down Your Files
First, create a text file named htaccess.txt
Next, add this content:
# File Access Restricter
RewriteEngine On
# 1) If NOT the current host
RewriteCond %{HTTP_HOST}@@%{HTTP_REFERER} !^([^@]*)@@https?://\1/.*
# 2) Deny access to these types
RewriteRule \.(gif|jpg|jpeg|png|tif|pdf|wav|wmv|wma|avi|mov|mp4|m4v|mp3|zip?)$ - [F]In the last line, you can change the file types that you want to restrict.
Next, put this file in the folder where your files are located.
Rename the file to: .htaccess
Note that this will make it a hidden file. If it disappears, don't panic. Turn on "Show Hidden Files" to see it.
Now flush your cache and try to access a file directly. You should get a Forbidden Error, but you should be able to open and download files from the pages on your site.
NOTE: This will break any incoming links to your files which may be on web pages or within emails messages since they are direct links.
IMPORTANT: If you are trying to protect access from your own WordPress users this solution can be easily circumvented. Users who can create posts or pages can create links to the files from their pages, then access the file by clicking on the link.
Last updated
Historical comments (17)
Comments are closed. The discussion below is retained for historical reference.