Title: Htaccess Secure Files Author: isaacchapman Published: October 26, 2011 Last modified: June 8, 2012 --- Search plugins This plugin **hasn’t been tested with the latest 3 major releases of WordPress**. It may no longer be maintained or supported and may have compatibility issues when used with more recent versions of WordPress. ![](https://s.w.org/plugins/geopattern-icon/htaccess-secure-files.svg) # Htaccess Secure Files By [isaacchapman](https://profiles.wordpress.org/isaacchapman/) [Download](https://downloads.wordpress.org/plugin/htaccess-secure-files.0.5.zip) * [Details](https://wordpress.org/plugins/htaccess-secure-files/#description) * [Reviews](https://wordpress.org/plugins/htaccess-secure-files/#reviews) * [Installation](https://wordpress.org/plugins/htaccess-secure-files/#installation) * [Development](https://wordpress.org/plugins/htaccess-secure-files/#developers) [Support](https://wordpress.org/support/plugin/htaccess-secure-files/) ## Description **The Htaccess Secure Files plugin can only be activated on Apache web servers with mod_rewrite enabled, and will automatically raise an error upon activation if this is not the case.** The Htaccess Secure Files plugin allows for setting files to be accessible only to visitors who have a specified IP address or [WordPress role or capability](https://codex.wordpress.org/Roles_and_Capabilities). By using [.htaccess files](http://en.wikipedia.org/wiki/Htaccess) to secure the content instead of a separate directory outside the web root, WordPress’s native media library functionality can be used to upload secure files and link to them from within the visual editor. By default all built-in WordPress roles will be allowed to access content that is marked as secure. The Settings -> Secure Files admin screen controls which roles, capabilities, and IP addresses are allowed to view or download secured files. If a custom role or capability is desired, there are several [WordPress plugins](https://wordpress.org/extend/plugins/search.php?q=roles+capabilities) capable of creating and editing roles and capabilities. **Any visitor that matches any selected role, capability, or IP address will be allowed to access secured files.** This plugin works by creating a .htaccess files in the directory of each secured file. If you manually edit the .htaccess file and it becomes corrupt (a 500 Internal Server Error is the most likely symptom), I recommend deleting the .htaccess file and then edit and save each secured item in the media library. ## Screenshots * [[ * Change the “Secured File” value to Yes on the Edit Media screen to secure a file. * [[ * Select the user roles that can access secured files. * [[ * Select the user capabilities that can access secured files. * [[ * Select which IP addresses can access secured files. ## Installation 1. Unzip the zip archive and upload the htaccess-secure-files directory to your /wp- content/plugins/ directory. 2. Activate the plugin through the ‘Plugins’ menu in WordPress. 3. On the ‘Settings’ -> ‘Secure Files’ admin screen select which roles, capabilities, and IP addresses will be allowed to access secure files and what the server response should be for those denied access. 4. To secure individual files edit the file on the ‘Media’ admin screen and change the ‘Secured File’ setting to ‘Yes’. ## Reviews There are no reviews for this plugin. ## Contributors & Developers “Htaccess Secure Files” is open source software. The following people have contributed to this plugin. Contributors * [ isaacchapman ](https://profiles.wordpress.org/isaacchapman/) [Translate “Htaccess Secure Files” into your language.](https://translate.wordpress.org/projects/wp-plugins/htaccess-secure-files) ### Interested in development? [Browse the code](https://plugins.trac.wordpress.org/browser/htaccess-secure-files/), check out the [SVN repository](https://plugins.svn.wordpress.org/htaccess-secure-files/), or subscribe to the [development log](https://plugins.trac.wordpress.org/log/htaccess-secure-files/) by [RSS](https://plugins.trac.wordpress.org/log/htaccess-secure-files/?limit=100&mode=stop_on_copy&format=rss). ## Changelog #### 0.5 * Adding smarter detection when WordPress is installed in a sub-directory of a site. #### 0.4 * MIME/Content-type detection routine expanded (in order of priority): 1) Use WordPress’s built-in (or plugin modified) MIME types. 2) Use Fileinfo PECL extension if installed. 3) Check with mime_content_type (deprecated). 4) Fallback to ‘application/octet- stream’. #### 0.3 * “Denied access response” is now customizable: WordPress login, 403 Forbidden, 404 Not Found, or custom redirect. #### 0.2 * Added “Secure” column to media manager list table * Added simple IP address whitelisting (may add more complexity in a later version) * Added the capability to hide/disable the admin interface with a define statement * Added screenshots #### 0.1 * Initial version ## Meta * Version **0.5** * Last updated **14 years ago** * Active installations **10+** * WordPress version ** 3.2.1 or higher ** * Tested up to **3.3.2** * Tags * [htaccess](https://wordpress.org/plugins/tags/htaccess/)[media](https://wordpress.org/plugins/tags/media/) [secure](https://wordpress.org/plugins/tags/secure/) * [Advanced View](https://wordpress.org/plugins/htaccess-secure-files/advanced/) ## Ratings 5 out of 5 stars. * [ 1 5-star review ](https://wordpress.org/support/plugin/htaccess-secure-files/reviews/?filter=5) * [ 0 4-star reviews ](https://wordpress.org/support/plugin/htaccess-secure-files/reviews/?filter=4) * [ 0 3-star reviews ](https://wordpress.org/support/plugin/htaccess-secure-files/reviews/?filter=3) * [ 0 2-star reviews ](https://wordpress.org/support/plugin/htaccess-secure-files/reviews/?filter=2) * [ 0 1-star reviews ](https://wordpress.org/support/plugin/htaccess-secure-files/reviews/?filter=1) [Your review](https://wordpress.org/support/plugin/htaccess-secure-files/reviews/#new-post) [See all reviews](https://wordpress.org/support/plugin/htaccess-secure-files/reviews/) ## Contributors * [ isaacchapman ](https://profiles.wordpress.org/isaacchapman/) ## Support Got something to say? Need help? [View support forum](https://wordpress.org/support/plugin/htaccess-secure-files/)