Frequently asked questions about Medifence.
Do my file URLs change?
No. Existing URLs in posts, themes, and the database keep working exactly as before. Physical files stay where they are, so no migration is needed. Logged-in visitors see no difference at all.
How do I know the protection is actually working?
The settings screen runs a live test: it creates a temporary file, requests it over HTTP without any session cookie, and reports the actual status code. If your server configuration prevents the rules from working, you will see it there — not months later. The status also appears under Tools → Site Health, and wp medifence status reports it where WP-CLI is available.
Can I keep some files public?
Yes. List a folder under “Excluded paths” and everything below it is served without a login check. You can also flip it around: choose “Protect only the paths listed below” and just those folders are protected while everything else is served normally. Extension-level exclusions (css, js, woff2, and so on) are available too.
Can I let someone without an account see one file?
Yes. Create a share link from the settings screen or the “Share link” action in the media library, choosing a lifetime between 1 hour and 30 days. The link is the file’s normal URL plus a signature, so it works for that one file only and stops working when it expires. “Revoke all share links” invalidates every link issued so far at once.
Does it work on nginx?
No. The plugin relies on .htaccess rewrite rules, which nginx does not read. An equivalent rule would be needed in your nginx configuration, which is outside what a plugin can safely manage.
What happens when I deactivate the plugin?
The rules are removed from the .htaccess file and all files are served normally again. Uninstalling additionally deletes all of the plugin’s settings (across every site on multisite).
Another plugin overwrote the .htaccess file. What now?
Medifence detects this and shows a warning on your admin screens; one click on “Regenerate .htaccess rules” restores them. A daily check also rewrites the rules on its own, so the protection comes back even if nobody logs in (you can turn that off in the settings). Because the rules are written with WordPress’s own marker mechanism, Medifence never breaks other plugins’ rules either.
A file is still reachable right after I enabled the protection. Why?
Files that were served before the protection was active — or while their folder or extension was excluded — may still sit in a server-side or CDN cache, and that copy is served without ever reaching WordPress. Medifence sends Cache-Control: private on everything it delivers itself, so protected files are never stored in a shared cache; the stale copy disappears once the cache entry expires, or immediately if you purge the cache. Verify with a fresh query string (for example ?x=1), which bypasses most caches.
Does this slow down my site?
Protected files are served through PHP, which adds overhead compared to direct file delivery. To keep this small, the plugin sends ETag headers so browsers of logged-in users cache files locally, and repeat requests are answered with an empty 304 response. Files in excluded folders or with excluded extensions bypass PHP entirely.
Does the plugin contact any external service?
No. The live test sends one HTTP request to your own site. Nothing is sent anywhere else.