Medifence – Access Control for Media Uploads

By default, every file inside the WordPress uploads directory can be opened by anyone who knows its URL. For membership sites this means that protected content pages are useless if the images inside them can still be opened directly.

Medifence puts a login check in front of every uploads request — without changing a single URL and without moving any files.

How it works

htaccess file inside your uploads directory (using WordPress’s own marker mechanism, so rules from other plugins are preserved). Requests for existing files are rewritten to WordPress itself, which bootstraps normally; the plugin then verifies the visitor is logged in and streams the file. No WordPress core file is ever loaded directly.

Deactivating or uninstalling the plugin removes the rules, and your files are served normally again.

Features

• File URLs stay exactly the same — nothing to update in posts or the database

• Physical files stay where they are — no migration needed

• Built-in live verification: the settings screen requests a test file without a session cookie and shows the actual HTTP status anonymous visitors receive

• A warning appears on all admin screens if another plugin overwrites the rules

• Optionally require a specific capability in addition to being logged in

• Or give individual folders their own capability, so one membership tier cannot reach another’s files

• Choose the denied status code (403, 404, or 401) — 404 hides that the file exists

• Or send visitors who open a protected file to the login screen, and back to the file afterwards

• Or to a page of your own — a membership or contact page, for people who have no account yet

• Either way they are told which file they were opening, so the redirect does not read as a broken site

• Optionally serve a placeholder image instead of denied images — your own, or the grey padlock included with the plugin

• Exclude specific file extensions (useful when your theme loads CSS or fonts from uploads)

• Excluding a document or archive type — pdf, zip, docx — is flagged before and after saving, so it never happens unnoticed

• Exclude individual folders, or flip it around and protect only the folders you list — picked from the folders you actually have

• Or let each file follow the post it is attached to: published posts stay public, private ones require a login

• Publish the generated image sizes a gallery needs while the full-resolution original stays protected

• WebP and AVIF copies made by an image optimizer follow the file they were made from — published size or protected original

• Make a single file an exception to all of that — always public, or always protected — from the media library

• Narrow the media library list to one protection state, to select what is exposed and fix it without leaving the screen

• A shortcode lists the files of a folder that the current visitor may download — the member page that never drifts out of date

• Share a single protected file with someone who has no account, using an expiring signed link — and revoke any of them individually

• Limit a share link to a number of downloads, note down who it was issued to, and see how often it has been used

• Give a share link a password as a second factor — only its hash is stored, and guessing is cut off after 20 wrong attempts

• Or select a set of files in the media library and get all their links in one go

• Set the lifetime and download limit the share forms start with, for sites that issue many links the same way

• Send a freshly issued link by email straight from the result box — no pasting, no misaddressing

• Or a whole set at once, as one message listing every link with its file name and expiry

• Start a link from a file’s own edit screen, with the file already selected

• Download the ledger of active links as CSV — without the links themselves, so a leaked ledger leaks no access

• Search that list by file name or note, or show only what expires within a day, and page through it

• Pause the protection for a few minutes while diagnosing a problem — it always resumes by itself, and the rules stay in place

• A daily check restores the rules automatically if another plugin removes or overwrites them

• What was overwritten is kept for you to inspect — the clue to which plugin keeps doing it

• Repeated overwrites are called out as a standing conflict, instead of being silently repaired forever

• Optionally emails you when the protection stops working — once, when the verdict changes

• And when the number of files anyone can open grows, which a working set of rules will never tell you

• That number is kept as a 30-day trend, so a scope drifting wider over weeks is visible at a glance

• The files that became reachable since the previous count are named, not just counted

• Or get one summary a week — reachable files, blocked requests, active links, settings changes — even when nothing happened

• Reports the protection status in Site Health, and offers WP-CLI commands for deployments

• A dashboard widget puts the vital signs on the admin home, seen without anyone going looking

• Warns when WP-Cron is not running — the silent way every scheduled check, alert, and summary stops

• Inspect any single file to see whether it is reachable, and which setting decided it

• Preview a settings change before saving it: see exactly which files would stop being protected

• Carry a configuration from staging to production as a JSON file, reviewed before it is applied

• See which administrator changed the protection, when, and from what to what — and undo a recorded change with one click

• Audit the whole library in one click and get the list of files your settings leave public — and close them from that same list

• Download that list as CSV, from the admin screen — the evidence a compliance process asks for

• Scan the uploads directory itself for files no attachment points at — the ones nothing else reports

• Scan published content for embedded protected files — the setting that shows up as a broken image on a public page

• Or be told at once: publishing a post checks that post and names the files its visitors will not be able to open

• The audit also names the attachments whose file is missing on disk, before someone issues a share link that cannot work

• Optionally count what was blocked, per file — without storing IP addresses or user agents — and download the list as CSV

• Including the share links that were refused, and the wrong passwords: why “the link you sent does not open”

• Choose how many files the log keeps and for how long, and see the last 7 days as one count per day

• See at a glance which files are protected, from a column in the media library

• The same verdict appears in the file dialog while inserting media into a post, and as a read-only REST field for administrators

• Choose whether allowed files open in the browser or always arrive as a download — video and audio keep playing either way

• Range request support for video and audio seeking, ETag-based browser caching for logged-in users

• Lock the configuration with a wp-config.php constant, for sites where the protection scope is agreed rather than casual

• Cleans up completely on uninstall

Requirements

• Apache or LiteSpeed with mod_rewrite enabled

• A writable.htaccess file in the uploads directory

htaccess files. The built-in live test will tell you immediately whether your server is compatible.

For developers

The final access decision can be filtered:

add_filter( 'medifence_allow_access', function ( $allowed, $file_path ) { // Example: always allow files inside uploads/public/. == strpos( $file_path, '/uploads/public/' ) ) { return true; } return $allowed; }, 10, 2 );

The WP-CLI commands, the diagnostic header, the [medifence_files] shortcode, the REST field, and the delivery details are described in the developer documentation.