Medifence – Access Control for Media Uploads is a WordPress plugin that restricts direct access to your uploaded media files to logged-in visitors only. File URLs and file locations stay exactly the same. It solves the membership-site problem where images and PDFs inside protected pages can still be opened by anyone who knows their URL.
On activation, the plugin writes a protection rule block into the .htaccess file inside your uploads directory, putting a login check in front of every file request. A built-in live test verifies that anonymous access is actually blocked — by requesting a test file over HTTP without a session cookie — so an incompatible server or a misconfiguration is caught immediately.
Key features
- URLs and file locations never change — existing URLs in posts, themes, and the database keep working. No migration.
- Folder-level protection scope — publish one folder, protect only the folders you list, or exclude by extension. Files can also follow the post they are attached to.
- Publish thumbnails, protect the original — name the generated image sizes anyone may see, so the gallery is open while the full resolution is not.
- A capability per folder — give each membership tier its own folder rule, and one tier cannot reach another’s files.
- Expiring share links — hand a single file to someone without an account, with an optional password, a download limit, a note, bulk issuing, one-press emailing, and a CSV ledger.
- Audit — list every file anyone can open with the reason, and close it from that same list. It also finds files no attachment points at, and protected files embedded in published pages — and says so the moment such a post is published. The list downloads as CSV.
- Self-healing rules — a daily check writes the rules back if another plugin removes them, and repeated overwrites are reported as a standing conflict.
- Notifications worth reading — email when the protection breaks, and when the number of files anyone can open grows. A weekly summary confirms the quiet weeks too.
- A record you can undo — which administrator changed what, and when, with one-click undo. Any change can be previewed before it is saved.
- Live verification, Site Health and WP-CLI — a real HTTP response decides whether the protection works, the dashboard and Site Health carry the verdict, and the command line reports it too. Media served from another host, which never reaches this plugin at all, is named for what it is.
- Choose what a denied visitor sees — a status code, the login screen, a page of your own, or a placeholder image (a padlock ships with the plugin). Either way they are told which file they opened, so a closed door does not read as a broken site. You also choose whether an allowed file opens in the browser or always arrives as a download.
Usage
Protection starts as soon as you activate the plugin. Media → Access Control is split into tabs: status, audit, access log, settings, share links, rules, and help. The protection scope, the image sizes anyone may see, per-folder capabilities, what a denied visitor receives (a status code, the login screen, or a page of your own), a placeholder image, the notifications, and the log retention can all be configured as needed.
Documentation (for developers)
The medifence_allow_access filter that overrides the final access decision, how share links are signed, the WP-CLI commands (with --format=json for scripts), the [medifence_files] shortcode that lists a folder for the visitor viewing the page, the read-only field on the media REST endpoint, the MEDIFENCE_LOCK_SETTINGS constant that freezes the configuration, the diagnostic X-Medifence response header, the generated .htaccess rules, and the delivery specification (ETag-based 304 responses, Range support for video seeking, and Cache-Control: private).
FAQ
“Do my file URLs change?”, “How do I know the protection is working?”, “Does it work on nginx?”, “Can I let someone without an account see one file?”, “What happens when I deactivate the plugin?” and more.
Changelog
The latest version is 1.63.1. Recent releases added per-folder capabilities (1.28.0), publishing image sizes while the original stays protected (1.30.0), passwords on share links (1.32.0), the member file shortcode (1.38.0), the dashboard widget (1.50.0), detection of media served from another host (1.54.0), a warning when a published post hides a file its readers cannot open (1.55.0), the audit as CSV (1.59.0), a built-in placeholder image (1.60.0), a protection filter in the media library (1.62.0), and the choice between opening in the browser and downloading (1.63.0). See the changelog for details of every version.
Requirements
| WordPress | 6.0 or higher (tested up to 7.0) |
| PHP | 7.4 or higher |
| Web server | Apache or LiteSpeed (mod_rewrite enabled, writable .htaccess in the uploads directory) |
| License | GPLv2 or later |
The plugin does not work on nginx, because nginx does not read .htaccess files. The built-in live test tells you immediately whether your server is compatible.