Media/Uploads restrictions

This article will help you secure your medias (any files uploaded) on WordPress. You need basic understanding of PHP and Apache to get it done. 

Note that by default, even if all your pages are restricted, any document uploaded can be accessed without any restriction, just with the URL. 

But they are not listed neither so as long as they are not shared no one will find theme. Nevertheless, it is something you might not want. 

Woffice has no impact, as a theme, on how we can restrict access to the uploads folder, this happen a couple levels below on the server configuration. 

So how to restrict access to the uploads/ folder only to logged in users? 

1. Edit your /.htaccess file and add the following lines: 

   RewriteCond %{REQUEST_FILENAME} -s
   RewriteRule ^wp-content/uploads/(.*)$ uploads-check.php?file=$1 [QSA,L]

2. Upload a uploads-check.php file with the following content inside: 

   <?php
   /*
    * uploads-check.php
    *
    * Protect uploaded files with login.
    * 
    * @link http://wordpress.stackexchange.com/questions/37144/protect-wordpress-uploads-if-user-is-not-logged-in
    * 
    * @author hakre <http://hakre.wordpress.com/>
    * @license GPL-3.0+
    * @registry SPDX
    */
   
   require_once('wp-load.php');
   
   is_user_logged_in() ||  auth_redirect();
   
   list($basedir) = array_values(array_intersect_key(wp_upload_dir(), array('basedir' => 1)))+array(NULL);
   
   $file =  rtrim($basedir,'/').'/'.str_replace('..', '', isset($_GET[ 'file' ])?$_GET[ 'file' ]:'');
   if (!$basedir || !is_file($file)) {
   	status_header(404);
   	die('404 — File not found.');
   }
   
   $mime = wp_check_filetype($file);
   if( false === $mime[ 'type' ] && function_exists( 'mime_content_type' ) )
   	$mime[ 'type' ] = mime_content_type( $file );
   
   if( $mime[ 'type' ] )
   	$mimetype = $mime[ 'type' ];
   else
   	$mimetype = 'image/' . substr( $file, strrpos( $file, '.' ) + 1 );
   
   header( 'Content-Type: ' . $mimetype ); // always send this
   if ( false === strpos( $_SERVER['SERVER_SOFTWARE'], 'Microsoft-IIS' ) )
   	header( 'Content-Length: ' . filesize( $file ) );
   
   $last_modified = gmdate( 'D, d M Y H:i:s', filemtime( $file ) );
   $etag = '"' . md5( $last_modified ) . '"';
   header( "Last-Modified: $last_modified GMT" );
   header( 'ETag: ' . $etag );
   header( 'Expires: ' . gmdate( 'D, d M Y H:i:s', time() + 100000000 ) . ' GMT' );
   
   // Support for Conditional GET
   $client_etag = isset( $_SERVER['HTTP_IF_NONE_MATCH'] ) ? stripslashes( $_SERVER['HTTP_IF_NONE_MATCH'] ) : false;
   
   if( ! isset( $_SERVER['HTTP_IF_MODIFIED_SINCE'] ) )
   	$_SERVER['HTTP_IF_MODIFIED_SINCE'] = false;
   
   $client_last_modified = trim( $_SERVER['HTTP_IF_MODIFIED_SINCE'] );
   // If string is empty, return 0. If not, attempt to parse into a timestamp
   $client_modified_timestamp = $client_last_modified ? strtotime( $client_last_modified ) : 0;
   
   // Make a timestamp for our most recent modification...
   $modified_timestamp = strtotime($last_modified);
   
   if ( ( $client_last_modified && $client_etag )
   	? ( ( $client_modified_timestamp >= $modified_timestamp) && ( $client_etag == $etag ) )
   	: ( ( $client_modified_timestamp >= $modified_timestamp) || ( $client_etag == $etag ) )
   	) {
   	status_header( 304 );
   	exit;
   }
   
   // If we made it this far, just serve the file
   readfile( $file );

For any question, please get in touch with us on the support.