just place an Index.php in that folder should work + a .htacess
http://codex.wordpress.org/htaccess_for_subdirectories
thx fyllhund for your reply!
My problem is not trying to avoid people from listing the contents of the uploads folder.
Instead, I need to avoid legitimate users from copying the link to any particular file (e.g. mysite.com/wp-content/uploads/mysupersecretcontent.pdf), sending the link to anybody else, then having those people grab the file from outside WP.
As far as I know, adding an index.php file would only limit the ability of users to list the contents of wp-content\uploads if they don’t add the actual file to the end of the URL.
Regarding the second part of your suggestion, I can’t limit access to the uploads folder for everybody, because I still need logged in users to be able to access the files. What I need to forbid is letting users not logged in to access the files.
Hmm. I guess something along the lines of this in .htaccess.
Not sure though so someone will have to verify
AuthUserFile /wp-content/uploads
AuthGroupFile /wp-content/uploads
AuthName "Example Access Control"
AuthType Basic
<LIMIT GET>
order allow, deny
deny from all
allow from xx.xx.xx.xx
</LIMIT>
fyllhund, thx again for your suggestions.
The last bit is not going to work, because I can’t limit access by IP address. My users are supposed to be able to access the site from anywhere.
I’ll try the rest of the “Auth..” directives to see what they actually do. The problem I forsee is that the ACL for WP is in its database and is not part of Linux (users logged onto WP are not necessarily logged onto Linux on the web server). So I would need to figure out how to tell Apache to read the WP database for the users. If I need to enter all users into a separate file it would be unmanageable 🙁
wow, I too think this is exactly what I need!! Thank you!
In fact, I think this is what WP should add to the core ASAP.
It’ll take me a while to package this into a plugin and add it to my site, but this is the approach I’ll take for sure.
If I manage to make a decent plugin, I’ll add it to the thread where your suggestion is found.
… of course I’ll check the plugins repository first. Somebody might’ve done it already.
thanks again!
Did you ever find a solution? We’re in the same boat. The solution in the above article has you place the files on the server but outside of the www root. Our site is hosted through Godaddy where we don’t have access above the root so this won’t work for us.
I’m on a time crunch. I’ve got about two weeks to figure out a solution to secure our files and a site presentable. Any help is greatly appreciated.
I don’t know of a pre-made solution, but a good approach is you put your downloadable files in a folder that is secured with a Deny All .htaccess file so that the files are not downloadable directly from a browser. Then in a secured members area (using one of the many members area plugins available) you have a script which can access that Deny All .htaccess protected folder and deliver the download from within the secured member area.
this is a fairly good general idea
http://stackoverflow.com/questions/7127153/php-how-can-i-block-direct-url-access-to-a-file-but-still-allow-it-to-be-downl
I’m proud to say that I have written a small plugin to easily fix your issue. No need to play in the code, with 5 lines of code this plugin will safely secure your Wp-Content directory and all subfolders in there (including /Uploads or /Media).
You can download it here: http://wordpress.org/extend/plugins/wp-safely-disable-directory-browsing/
I appreciate if you could leave a rating for this afterwards.
Thank you.
