Title: Uploaded documents security risk
Last modified: August 19, 2026

---

# Uploaded documents security risk

 *  [swisstech](https://wordpress.org/support/users/swisstech/)
 * (@swisstech)
 * [2 weeks, 4 days ago](https://wordpress.org/support/topic/uploaded-documents-security-risk/)
 * We use participant database plugin to let users upload identifying documents.
   We notice that anyone with the URL to uploaded documents are able to access them.
   Is there anyway to add security to this – not displaying the URL or restricting
   access only to those who uploaded these files? We couldn’t find any setting in
   the participant database plugin setting to this effect anywhere. Please help 
   as this is a top concern of ours. 

Viewing 1 replies (of 1 total)

 *  Plugin Author [rolandbarker](https://wordpress.org/support/users/rolandbarker/)
 * (@rolandbarker)
 * [2 weeks, 3 days ago](https://wordpress.org/support/topic/uploaded-documents-security-risk/#post-18997627)
 * The way the plugin works, only way to secure such documents is to keep that URL
   secret. This is what private fields are for: these are fields that are in a field
   group that is set to private visibility. Only an administrator or the person 
   with access to the record will see the content of those fields, and therefore
   know the URL to the uploaded file.
 * A step you can take to make that URL harder to guess is to change the “File Upload
   Location” setting to point to your own custom directory name. Easiest way to 
   do this is to rename the directory where the uploaded files are stored in the“
   wp-content/uploads/” standard WP directory. By default this is “participants-
   database” but it can be anything you choose. Change the name of the directory
   on the server, and then change the “File Upload Location” setting in the plugin
   to point to that renamed directory.
 * Participants Database is not well suited to applications where high security 
   is needed, we don’t advise using it to keep files or data that is very sensitive
   or valuable, such as credit card numbers, account numbers, etc. This is because
   while we can make it hard to do things like access uploaded files, we can’t make
   it impossible.
 * The plugin is designed such that someone with coding skills can implement more
   secure ways to keep uploaded files so that they can’t be accessed by a URL, but
   the plugin doesn’t do this natively.

Viewing 1 replies (of 1 total)

You must be [logged in](https://login.wordpress.org/?redirect_to=https%3A%2F%2Fwordpress.org%2Fsupport%2Ftopic%2Fuploaded-documents-security-risk%2F%3Foutput_format%3Dmd&locale=en_US)
to reply to this topic.

 * ![](https://ps.w.org/participants-database/assets/icon-256x256.jpg?rev=1389807)
 * [Participants Database](https://wordpress.org/plugins/participants-database/)
 * [Frequently Asked Questions](https://wordpress.org/plugins/participants-database/#faq)
 * [Support Threads](https://wordpress.org/support/plugin/participants-database/)
 * [Active Topics](https://wordpress.org/support/plugin/participants-database/active/)
 * [Unresolved Topics](https://wordpress.org/support/plugin/participants-database/unresolved/)
 * [Reviews](https://wordpress.org/support/plugin/participants-database/reviews/)

 * 1 reply
 * 2 participants
 * Last reply from: [rolandbarker](https://wordpress.org/support/users/rolandbarker/)
 * Last activity: [2 weeks, 3 days ago](https://wordpress.org/support/topic/uploaded-documents-security-risk/#post-18997627)
 * Status: not resolved