How to use Medifence. Everything is done from Media → Access Control (requires the manage_options capability).
1. Activate
Activating the plugin automatically writes the protection rules into the .htaccess file inside your uploads directory, and protection starts right away. The rules are written with WordPress’s own marker mechanism (insert_with_markers()), so rules from other plugins are preserved. File URLs and locations do not change, and logged-in visitors see no difference at all.
2. Check the protection status
The “Protection Status” section at the top of the settings screen shows five items: the presence of the rules, rule integrity, write permission, mod_rewrite, and the live test. The live test creates a temporary file, requests it over HTTP without any session cookie, and verifies that anonymous access is actually blocked — reporting the real status code. You can re-run it any time with “Run test again”.
The status also appears under Tools → Site Health. When your media files are not protected, it is reported as a critical issue, so you find out without opening the settings screen.
3. Choose the protection scope
By default the whole uploads directory is protected. Two modes are available:
- Protect everything except the excluded paths (default) — protect everything, then list the folders you want to keep public under “Excluded paths”. Useful when only a few assets, such as logos or flyers, should stay open.
- Protect only the paths listed — only the folders under “Protected paths” are protected; everything else is served normally. Useful when just one area, such as member documents, needs protection.
Write one path per line, relative to the uploads directory (for example public or 2026/private). The path itself and everything below it is covered. Files in excluded folders bypass PHP entirely, so they are served at full speed.
Extension-level exclusions are also available (for example css, js, woff2). Use them when your theme or other plugins load assets from the uploads directory for anonymous visitors.
4. Other settings
- Required capability — leave empty to allow any logged-in user, or enter a capability name (e.g.
read) to require it in addition to being logged in. - Denied status code — choose 403, 404, or 401. Choosing 404 hides that the file exists at all.
- Automatic repair (enabled by default) — checks the rules once a day and rewrites them if they are missing or outdated. If another plugin overwrites your
.htaccess, the protection returns before anyone notices. The time of the last repair is shown on the settings screen. - Placeholder image attachment ID — when set, denied image requests receive this placeholder instead of the original (the original is never served).
Saving also rewrites the .htaccess rules and re-runs the live test.
5. Share a single file
To hand one file to someone without an account, create a share link. Either click “Share link” on the file’s row in the media library, or enter the attachment ID and a lifetime (1 hour / 1 day / 7 days / 30 days) in the “Share links” section of the settings screen.
The resulting link is the file’s normal URL plus a signature and an expiry. Because the signature covers both the file path and the expiry, the link cannot be reused for another file, and the deadline cannot be tampered with. The link is shown only once, so copy it right away. To invalidate every link issued so far, use “Revoke all share links”.
6. Verify it yourself
Open a media file URL in a private browsing window and confirm that it is blocked. Responses blocked by Medifence carry the diagnostic X-Medifence header, so you can also verify it in your browser’s developer tools.
Where WP-CLI is available, wp medifence status reports the same thing. It exits with a non-zero status when the protection is not working, which makes it suitable for automated checks after a deployment.