Medifence – Access Control for Media Uploads is a WordPress plugin that restricts direct access to your uploaded media files to logged-in visitors only. File URLs and file locations stay exactly the same. It solves the membership-site problem where images and PDFs inside protected pages can still be opened by anyone who knows their URL.
On activation, the plugin writes a protection rule block into the .htaccess file inside your uploads directory, putting a login check in front of every file request. A built-in live test verifies that anonymous access is actually blocked — by requesting a test file over HTTP without a session cookie — so an incompatible server or a misconfiguration is caught immediately.
Key features
- URLs and file locations never change — existing URLs in posts, themes, and the database keep working. No migration.
- Folder-level protection scope — publish one folder, or protect only the folders you list. Extension-level exclusions are available too.
- Expiring share links — hand a single file to someone without an account, valid only until it expires.
- Self-healing rules — if another plugin removes the rules, a daily check writes them back.
- Live verification — a real HTTP response decides whether the protection works, so “I thought it was protected” never happens.
- Site Health and WP-CLI — check the protection status without opening the settings screen.
Usage
Protection starts as soon as you activate the plugin. Go to Media → Access Control to check the protection status (rules, mod_rewrite, and the live test). The protection scope, excluded extensions, an additional required capability, the denied status code, a placeholder image, and automatic repair can be configured as needed.
Documentation (for developers)
The medifence_allow_access filter that overrides the final access decision, how share links are signed, the WP-CLI commands, the diagnostic X-Medifence response header, the generated .htaccess rules, and the delivery specification (ETag-based 304 responses, Range support for video seeking, and Cache-Control: private).
FAQ
“Do my file URLs change?”, “How do I know the protection is working?”, “Does it work on nginx?”, “Can I let someone without an account see one file?”, “What happens when I deactivate the plugin?” and more.
Changelog
The latest version is 1.17.0. Recent releases added an audit that lists every file your settings leave public (1.13.0), an optional log of what was blocked (1.14.0), per-file exceptions (1.15.0), an email notification when the protection stops working (1.16.0), and input help for the protection scope (1.17.0). See the changelog for details of every version.
Requirements
| WordPress | 6.0 or higher (tested up to 7.0) |
| PHP | 7.4 or higher |
| Web server | Apache or LiteSpeed (mod_rewrite enabled, writable .htaccess in the uploads directory) |
| License | GPLv2 or later |
The plugin does not work on nginx, because nginx does not read .htaccess files. The built-in live test tells you immediately whether your server is compatible.