How to use Medifence. Everything is done from Media → Access Control (requires the manage_options capability). The screen is split into tabs: protection status, audit, access log, settings, share links, rules and help.
1. Activate
Activating the plugin automatically writes the protection rules into the .htaccess file inside your uploads directory, and protection starts right away. The rules are written with WordPress’s own marker mechanism (insert_with_markers()), so rules from other plugins are preserved. File URLs and locations do not change, and logged-in visitors see no difference at all.
2. Check the protection status
The “Protection Status” section at the top of the settings screen shows five items: the presence of the rules, rule integrity, write permission, mod_rewrite, and the live test. The live test creates a temporary file, requests it over HTTP without any session cookie, and verifies that anonymous access is actually blocked — reporting the real status code. You can re-run it any time with “Run test again”.
The status also appears under Tools → Site Health. When your media files are not protected, it is reported as a critical issue, so you find out without opening the settings screen.
3. Choose the protection scope
By default the whole uploads directory is protected. Two modes are available:
- Protect everything except the excluded paths (default) — protect everything, then list the folders you want to keep public under “Excluded paths”. Useful when only a few assets, such as logos or flyers, should stay open.
- Protect only the paths listed — only the folders you name are protected; everything else is served normally. Use this when a limited area, such as member documents, is what needs protecting.
- Follow the post each file is attached to — files attached to a published post are served to everyone, while files on a draft, private, or password-protected post require a login. For sites where public and members-only content share the same folders.
Write one path per line, relative to the uploads directory (for example public or 2026/private). The path itself and everything below it is covered. Files in excluded folders bypass PHP entirely, so they are served at full speed.
Extension-level exclusions are also available (e.g. css, js, woff2), for when your theme or another plugin loads files from the uploads directory for anonymous visitors. Excluding a document or archive type such as pdf or zip raises a warning — those are the files the protection usually exists for (nothing is blocked).
Images can have their generated sizes published on their own. Tick the sizes under “Image sizes anyone may see” and the gallery thumbnails are open to everyone while the full resolution stays for members. The original and the -scaled copy are never among them.
Folders can require their own capability. On a site with several membership tiers, give members/gold a capability of its own and a member without it cannot open the files inside — the most specific folder decides.
4. Other settings
- Required capability — leave empty to allow any logged-in user, or enter a capability name (e.g.
read) to require it in addition to being logged in. - What a denied visitor receives — a status code (403, 404, or 401; 404 hides that the file exists at all), a redirect to the login screen, or a page of your own, such as a membership page.
- Automatic repair (enabled by default) — checks the rules once a day and rewrites them if they are missing or outdated. If another plugin overwrites your
.htaccess, the protection returns before anyone notices. The time of the last repair is shown on the settings screen. - Placeholder image attachment ID — when set, denied image requests receive this placeholder instead of the original (the original is never served).
- Email notifications — one message when the protection breaks and one when it works again, and one when the number of files anyone can open grows. A weekly summary reports the state even when nothing happened.
- Access log — counts blocked requests and share link downloads per file, without storing IP addresses or user agents. How many files it keeps and for how long is configurable, and the log can be downloaded as CSV.
- A record you can undo — every change to the settings that decide access is recorded with who made it, and can be undone with one click. “Preview the effect” shows which files would stop being protected before you save.
Saving also rewrites the .htaccess rules and re-runs the live test.
5. Share a single file
To hand one file to someone without an account, create a share link. Either click “Share link” on the file’s row in the media library, or enter the attachment ID and a lifetime (1 hour / 1 day / 7 days / 30 days) in the “Share links” section of the settings screen.
The link is the file’s normal URL plus a signature and an expiry. The signature covers both the path and the expiry, so it cannot be reused for another file or kept alive past its date. A link can carry a password (a second factor against forwarding), a download limit, and a note recording who it went to — and it can be emailed straight from the result box. Select several files in the media library to issue links in bulk. Every active link can be revoked on its own, and the list can be downloaded as a CSV ledger (which deliberately does not contain the links themselves). “Revoke all share links” replaces the signing key, so everything issued so far stops working at once.
6. Find out what is reachable
The audit tab exists to destroy the phrase “I thought it was protected”. It applies your settings to the library and lists every file a logged-out visitor can open, with the reason. Files can be set to “always protected” from that list, and the scan runs again immediately, so what remains is what is still reachable.
It can also walk the uploads directory itself and find the files no attachment points at — leftovers from a migration and the like. In the other direction, it reports protected files embedded in published pages (which visitors see as broken images) and attachments whose file has vanished from disk. Files that became reachable since the previous daily count are named.
7. Verify it yourself
Open a media file URL in a private browsing window and confirm that it is blocked. Responses blocked by Medifence carry the diagnostic X-Medifence header, so you can also verify it in your browser’s developer tools.
If WP-CLI is available, wp medifence status reports the same verdict and exits non-zero when the protection is not working, which makes it usable as a post-deployment check (--format=json prints the full report for scripts). The admin dashboard also carries the vital signs: the rules, how many files anyone can open, the active share links, and whether the scheduled checks run.