Title: MediaKnight Author: vivango Published: October 13, 2026 Last modified: October 13, 2026 --- Search plugins ![](https://ps.w.org/mediaknight/assets/icon-256x256.png?rev=3743006) # MediaKnight By [vivango](https://profiles.wordpress.org/vivango/) [Download](https://downloads.wordpress.org/plugin/mediaknight.1.0.2.zip) * [Details](https://wordpress.org/plugins/mediaknight/#description) * [Reviews](https://wordpress.org/plugins/mediaknight/#reviews) * [Installation](https://wordpress.org/plugins/mediaknight/#installation) * [Development](https://wordpress.org/plugins/mediaknight/#developers) [Support](https://wordpress.org/support/plugin/mediaknight/) ## Description **Your private page is not protecting your files.** A WordPress page can be members-only, but the PDFs and images on it still live in the Media Library with a public uploads address. Anyone who has that direct link can open the file, share it further, and leaked links can end up in search results. MediaKnight closes that gap. Protect a file and it moves out of the public uploads path, so the old direct link stops working for visitors. Logged-in users still open it through a WordPress access check, and protected downloads are sent with noindex headers. You keep working in the normal Media Library: click Protect, done. #### Who uses it * **Client portals:** contracts, reports and deliverables only for clients who log in. * **Course and membership material:** workbooks, slides and downloads for logged- in students or members. MediaKnight works with WordPress logins; it does not integrate with a specific LMS or membership plugin. * **Internal documents:** handbooks, procedures and HR files for your team’s WordPress accounts. * **Invoices and quotes:** PDFs your customers open after logging in, not via a forwarded link. * **Photographers:** show proofs to clients who log in, without the image files being openable by anyone with the URL. #### What the free plugin does The free plugin works on its own, with no account, payment, trial expiry or file quota. * Protect and unprotect files from the Media Library list and the attachment editor. * Logged-in access to protected files, and continued enforcement of previously saved role restrictions. * Protects registered image sizes, originals and editing backups, not just the main file. * Check server protection: an anonymous test that confirms the direct link is really blocked on your hosting. * Apache works out of the box when .htaccess rules are allowed; on Nginx your host adds a short snippet the plugin generates. * A privacy-safe blocked-file page in the visitor’s supported browser language, with English fallback and optional local MediaKnight branding. * Controlled downloads with noindex headers and HTTP Range support for large files. * Interface translations come from translate.wordpress.org language packs; no translation files are bundled with the plugin. * Safe recovery and revocation of existing signed links from a separate extension or earlier installation. #### MediaKnight Pro (optional) Everything described above is free and stays free: no account, quota or expiry. MediaKnight Pro is a separate add-on for sites that need more control: choose which WordPress roles can open each file, protect files in bulk, protect new uploads automatically, and share temporary, revocable links with optional click limits. Try Pro for free — features and pricing: https://plugins.vivango.com/mediaknight/# plans If Pro ends, your saved protection rules stay in place and files remain protected by the free plugin. Existing role restrictions are not broadened to all logged-in users. Pro is distributed outside WordPress.org. The free plugin contains no Pro licensing client or locked Pro implementation and does not download/install that extension. The optional Freemius connection and its data sharing are explained below. #### Technical details * Protected files and their registered variants move to `wp-content/uploads/mediaknight/`( the mediaknight folder inside your uploads directory); attachment metadata is updated and the attachment stays in the Media Library. * The files MediaKnight creates are kept in that folder: protected media, its access rule (.htaccess), an empty index.php, a lock file and, only if your host has enabled it, the Apache collector’s working files. Outside that folder, the plugin only adds one marked block to the .htaccess file of the uploads directory on Apache. * Self-repair: MediaKnight checks its own helper files on normal WordPress requests and recreates them if they are missing. It never overwrites a file it did not create. If a helper cannot be restored, it keeps access closed: its download route returns an error instead of a file, new protection stops and a notice appears on the MediaKnight and Media Library screens. * Downloads go through WordPress access checks, with HTTP Range streaming. Server requirements for Apache and Nginx, and the cache exclusions, are listed under Installation. ## Screenshots [⌊Settings > MediaKnight: the server protection check confirms that direct links are blocked on your hosting, with the Nginx setup option and optional blocked-file branding.⌉⌊Settings > MediaKnight: the server protection check confirms that direct links are blocked on your hosting, with the Nginx setup option and optional blocked- file branding.⌉[ Settings > MediaKnight: the server protection check confirms that direct links are blocked on your hosting, with the Nginx setup option and optional blocked-file branding. [⌊The one-click Protect action and protection status in the normal Media Library list.⌉⌊The one-click Protect action and protection status in the normal Media Library list.⌉[ The one-click Protect action and protection status in the normal Media Library list. [⌊The attachment editor: choose logged-in access for a single file.⌉⌊The attachment editor: choose logged-in access for a single file.⌉[ The attachment editor: choose logged-in access for a single file. [⌊What a logged-out visitor sees on a protected file's link: a privacy-safe blocked- file page in their browser language.⌉⌊What a logged-out visitor sees on a protected file's link: a privacy-safe blocked-file page in their browser language.⌉[ What a logged-out visitor sees on a protected file’s link: a privacy-safe blocked- file page in their browser language. [⌊A logged-in client downloads the protected file normally from a client portal page.⌉⌊A logged-in client downloads the protected file normally from a client portal page.⌉[ A logged-in client downloads the protected file normally from a client portal page. ## Installation 1. Install MediaKnight or upload its ZIP via Plugins > Add New > Upload Plugin. The repository root is not the plugin ZIP. 2. Activate per site. In the optional welcome, choose to try Pro or keep using free. Your choice is remembered and starts no registration. Pro is a separate plugin and requires explicit trial confirmation; in Freemius packages it is obtained through the optional Freemius connection. Network activation is not supported in v1. 3. Open Settings > MediaKnight and run Check server protection. 4. Apache needs writable uploads and AllowOverride permitting access rules and Options- Indexes. Existing unrelated .htaccess content is preserved. 5. Nginx users: ask the hosting provider to apply the generated snippet in the existing server block, validate with nginx -t and reload. Then repeat the check. See docs/ NGINX.md. A proxy/CDN serving uploads must also enforce protection. 6. Exclude the MediaKnight admin-post error routes, ?mlp_denied=1, ?mlp_missing=1,? mlp_download=… and /mlp-download/ from page, proxy and CDN caches. Purge any previously public copies. 7. In Media Library choose Protect, or edit an attachment to choose logged-in access. File-management actions require manage_options and edit_post for that attachment. ## FAQ ### Why is my file still public when the page is private? WordPress serves Media Library files directly from the uploads folder. A login on the page does not apply to the file’s own URL. MediaKnight moves a protected file out of that public path, so the direct link stops working for visitors while logged- in users can still open it. ### Does it work on Nginx? Yes, with a server rule. Nginx does not read .htaccess files. MediaKnight generates a site-specific snippet; your host adds it to the existing server block, validates with nginx -t and reloads. Then run Check server protection again. Without that rule, protection is not active on Nginx. ### What happens to old direct links? After you protect a file, its old direct link no longer works for visitors. The blocked-file page does not show the file name or internal path; a refused download or direct protected path keeps status 403. Use the shown download URL or insert an image again. Existing hard-coded URLs in posts are not rewritten. Administrators get no exception to the chosen access rule. ### Does the free version expire? No. Manual protection, access rules, server checks and downloads remain free. There is no license server or account requirement for these functions. ### How is the file protected? The plugin moves the file and its registered WordPress variants into `wp-content/ uploads/mediaknight/`, updating attachment metadata. The originals leave the public path. Download URLs go through WordPress access checks. The attachment stays in the Media Library. Copies created outside registered metadata are not tracked. ### What happens if someone deletes the mediaknight folder? MediaKnight recreates its own helper files automatically, but it cannot recreate your protected media: those files are stored only in `wp-content/uploads/mediaknight/`, so deleting the folder deletes them. MediaKnight then reports the missing files on the MediaKnight and Media Library screens; it never moves, replaces or invents files to fill the gap. Keep regular backups that include this folder and restore it from your backup if needed. Cleanup, optimization, cache and security plugins must not delete or “clean” this folder or its .htaccess file; exclude it in their settings. ### What happens when I deactivate or uninstall? Deactivation keeps protected files blocked; reactivate the base plugin to resume downloads. Uninstall restores media to their original directory and removes plugin settings, metadata and generated Apache rules. Restored files become public. Media files are never deleted by uninstall. On conflicts or interrupted moves, uninstall stops for recovery; see docs/DEVELOPMENT.md. Remove manual Nginx rules only after successful restoration. ### Can I change selected roles without Pro? Role selection is supplied by the separate Pro extension. Existing saved role rules remain enforced without Pro. Keep the existing restriction when saving an attachment to preserve both access and existing links. Switching to logged-in access or public explicitly broadens access. ### What happens if Pro is removed or its trial ends? The free protection and access rules keep working. Existing signed links keep their original expiry, click limit and access rules, and can be revoked in the base plugin. If automatic protection was enabled and its extension is inactive, new uploads are stopped to prevent accidental publication. Settings offers an explicit action to disable automatic protection; existing files remain protected. ### What are the limits? Local WordPress uploads only. No offload, S3/R2, watermarking, file sales, membership/ form integration or document portal in v1. Hosting execution limits apply to large downloads. Multipart ranges are rejected. Active file types are served as downloads. Previously downloaded/cached copies cannot be recalled. Protection must be enforced on every host serving uploads. A failed anonymous loopback/TLS check blocks new protection until hosting is fixed. ### What data does the free plugin store or send? It stores attachment protection settings and site settings locally. Existing signed- link records contain expiration and click counters. Approximate rate limiting uses a salted hash of the connecting IP in a transient expiring after 120 seconds; the plugin does not store raw IP addresses. Expired database entries may remain until WordPress cleanup. The server check requests a harmless temporary file on your own configured uploads URL without login cookies. Free activation and ordinary free protection do not initialize the optional Freemius connection. Optional public error- page branding uses only bundled assets. WordPress authentication and hosting access logs are separate. The MediaKnight uninstall routine makes no network request. The optional savings meter is off by default. Only after you switch it on, it records per day, locally in its own database tables, which external domains tried to load files from your site. This data is not sent anywhere. ### Optional external service: Freemius Packages with the Freemius SDK offer a voluntary Pro connection in Settings > MediaKnight. Nothing is sent to Freemius unless you explicitly continue, the server protection check succeeds and you then opt in on the Freemius connection screen (you can also skip). Only after that opt-in, or after starting a trial or activating a license, the SDK contacts api.freemius.com for connection, trial, purchase, licensing and premium updates. The connection screen lists the permissions requested. Per Freemius’ data practices this covers the opted-in administrator’s name and email address, the site URL, plugin version and state (active, inactive, uninstalled), WordPress and PHP versions and site language; the data is re-synced at most daily when it changes. The list of installed plugins/themes is a separate optional permission: our configuration sets it off by default, and the connection screen shows a switch so you decide. Our configuration also sets the SDK newsletter permission off; the SDK’s standard connection text may still mention update/offer emails, so only opt in if you agree with the text shown. Connected sites receive periodic licensing/update checks. MediaKnight does not attach media files, protected URLs or visitor records to this integration. Free protection does not require connecting or paying. Freemius provides its own account/ disconnection controls after connection. If you buy or trial Pro under the Freemius route, checkout runs on checkout.freemius. com. Freemius acts as the authorized reseller and merchant of record for that sale( payment processing, VAT/sales tax and invoice); name, email and billing details you enter there go directly to Freemius. For opt-in usage and licensing data, Freemius acts on behalf of the plugin owner as data processor, as described in its data practices. Service: https://freemius.com/ Terms: https://freemius.com/terms/ Privacy: https:// freemius.com/privacy/ Data practices: https://freemius.com/privacy/data-practices/ ### Where can I get help or give feedback? Use this plugin’s WordPress.org support forum. Include the relevant error message and server type when useful, but never post passwords, license credentials, private file URLs or customer documents. The separate Pro extension also offers a voluntary feedback form and optional departure question. ### Important limits MediaKnight limits access to files in your uploads folder. It cannot control copies already held by a CDN or cache, or server rules it cannot write (on Nginx your host must apply them). Run Check server protection again after server changes. Keep your own backups. MediaKnight is not a complete security solution and is provided without a guarantee that files can never be accessed without authorisation. Highly sensitive files do not belong in a publicly reachable uploads folder, even with MediaKnight. ### Does this guarantee that my website meets privacy laws? No. This plugin controls access to supported media files. It does not certify legal compliance or prevent an authorized recipient from copying a downloaded file. ## Reviews There are no reviews for this plugin. ## Contributors & Developers “MediaKnight” is open source software. The following people have contributed to this plugin. Contributors * [ vivango ](https://profiles.wordpress.org/vivango/) [Translate “MediaKnight” into your language.](https://translate.wordpress.org/projects/wp-plugins/mediaknight) ### Interested in development? [Browse the code](https://plugins.trac.wordpress.org/browser/mediaknight/), check out the [SVN repository](https://plugins.svn.wordpress.org/mediaknight/), or subscribe to the [development log](https://plugins.trac.wordpress.org/log/mediaknight/) by [RSS](https://plugins.trac.wordpress.org/log/mediaknight/?limit=100&mode=stop_on_copy&format=rss). ## Changelog #### 1.0.2 * Updated Freemius SDK to the latest version * Internal documentation is excluded from release packages. * Plugin identifiers use MediaKnight names. Legacy settings and metadata are copied and verified before the old keys are removed; unresolved conflicts retain both values for recovery. * The inline media panel supports collapsing and uses the saved above/below-description position. #### 1.0.1 * MediaKnight now keeps its files in `wp-content/uploads/mediaknight/`. Files protected by an earlier build in `uploads/mlp-protected/` are moved there automatically, in small batches while an administrator uses wp-admin: each file is copied and checked before the old copy is removed, an interrupted move resumes, and the old location stays blocked during the move. * Settings, per-file protection data and the plugin’s database tables are migrated to new MediaKnight names. Existing values are not overwritten, and the former names stay readable for MediaKnight Pro 1.0.3. If a migration step fails, files stay blocked for visitors and the step is tried again on a later request. * Self-repair of MediaKnight’s own helper files; if repair is not possible, access stays closed and a notice appears on MediaKnight and Media Library screens. * The index.php helper in protected storage is now an empty file. * Translations now come from translate.wordpress.org; the plugin no longer bundles translation files. * MediaKnight notices are limited to MediaKnight and Media Library screens. #### 1.0.0 Initial permanent free edition: manual file protection, logged-in access, enforcement of saved rules, localized privacy-safe blocked-file pages, Apache/Nginx checks, controlled downloads and safe recovery. Pro is a separately installed extension. ## Meta * Version **1.0.2** * Last updated **2 days ago** * Active installations **Fewer than 10** * WordPress version ** 6.0 or higher ** * Tested up to **7.1.3** * PHP version ** 7.4 or higher ** * Tags * [access-control](https://wordpress.org/plugins/tags/access-control/)[media library](https://wordpress.org/plugins/tags/media-library/) [private files](https://wordpress.org/plugins/tags/private-files/)[protect pdf](https://wordpress.org/plugins/tags/protect-pdf/) [protect uploads](https://wordpress.org/plugins/tags/protect-uploads/) * [Advanced View](https://wordpress.org/plugins/mediaknight/advanced/) ## Ratings No reviews have been submitted yet. [Your review](https://wordpress.org/support/plugin/mediaknight/reviews/#new-post) [See all reviews](https://wordpress.org/support/plugin/mediaknight/reviews/) ## Contributors * [ vivango ](https://profiles.wordpress.org/vivango/) ## Support Got something to say? Need help? [View support forum](https://wordpress.org/support/plugin/mediaknight/)