The way the plugin works, only way to secure such documents is to keep that URL secret. This is what private fields are for: these are fields that are in a field group that is set to private visibility. Only an administrator or the person with access to the record will see the content of those fields, and therefore know the URL to the uploaded file.
A step you can take to make that URL harder to guess is to change the “File Upload Location” setting to point to your own custom directory name. Easiest way to do this is to rename the directory where the uploaded files are stored in the “wp-content/uploads/” standard WP directory. By default this is “participants-database” but it can be anything you choose. Change the name of the directory on the server, and then change the “File Upload Location” setting in the plugin to point to that renamed directory.
Participants Database is not well suited to applications where high security is needed, we don’t advise using it to keep files or data that is very sensitive or valuable, such as credit card numbers, account numbers, etc. This is because while we can make it hard to do things like access uploaded files, we can’t make it impossible.
The plugin is designed such that someone with coding skills can implement more secure ways to keep uploaded files so that they can’t be accessed by a URL, but the plugin doesn’t do this natively.
