How to Protect Your Document Downloads from Direct Access with DLP Power Pack
When you upload a PDF, whitepaper, or any file to WordPress, it lands in the public uploads folder — and that means anyone who knows or can guess the URL can download it, regardless of whether you ever linked to it. Search engines index these URLs, browser history exposes them, and a determined user can enumerate /wp-content/uploads/YYYY/MM/ to find files you never intended to share openly.
Document Library Power Pack’s Secure Download system closes that gap. It moves document files into a web-inaccessible folder and routes all download requests through a WordPress-authenticated proxy. The result: files can only be downloaded by users your site has explicitly permitted — no direct URL access, no workarounds.
How the Protection Works
When a document is secured, its file is stored in /wp-content/uploads/dlp-protected/ rather than the standard uploads directory. An Apache .htaccess file inside that folder blocks all direct HTTP requests with a Deny from all rule, so the file simply cannot be fetched through the browser by URL. If your server runs Nginx, a deny all block in your server config achieves the same result — Power Pack displays a notice with the exact snippet to add.
Downloads are served through a WordPress proxy URL in the format /?dlp_download=123. When a visitor clicks a download link, WordPress intercepts the request, checks whether the user is logged in, verifies their category permissions, and only then streams the file directly from the protected folder. The visitor never sees or handles the real file path.
If a user who isn’t logged in tries to download a protected document, they’re redirected to the WordPress login page. After logging in, WordPress returns them directly to their original download request — no hunting around for the file again.
Restricting Downloads to Logged-In Users
Secure file storage handles where the file lives. Access control handles who can reach it. Both work together, and both are configured at the category level.
Go to Documents → Categories, edit any category, and you’ll find a View Permission setting. Set this to Logged-in Users Only and every document in that category will be off-limits to guests. You can also restrict to specific roles — useful if you want subscriber-only or editor-only document sets.
Permissions are inherited down the category tree. Set a parent category to “Logged-in Users Only” once, and every child category automatically follows that rule. You don’t need to configure each one individually. Individual categories can override the setting if needed, but the default is to inherit — which keeps things consistent without ongoing admin work.
Enabling Secure Storage at the Category Level
Rather than moving files after the fact, you can configure categories to store uploads securely from the moment they’re created.
Edit any Document Category and look for the Secure File Storage section. Check “Store uploads for this category in the protected folder” and save. From that point on, any file uploaded to a document in that category goes directly into dlp-protected/ — no extra steps, no bulk action required.
The interface shows (Currently inheriting: No) or (Currently inheriting: Yes) next to the section heading. This tells you at a glance whether the current category has its own setting or is picking it up from a parent. If a parent category has secure storage enabled, child categories inherit it automatically and the checkbox is locked — you’ll see a note explaining that “Secure storage is enforced by a parent category and cannot be disabled here.”
If you want to protect everything on your site, go to DLP Power Pack → Category Permissions and enable Secure Document Uploads globally. This acts as the default for any category that hasn’t been configured individually.
Uploading Securely via the Frontend Form
DLP Power Pack includes a frontend document upload form, added to any page with the [dlp_frontend_create] shortcode. Document contributors can submit files directly from the front end — they get a clean form with fields for title, file upload, category assignment, description, and more. No admin access required.
Because the category’s Secure File Storage setting is applied at upload time, a contributor who selects a protected category will have their file stored in dlp-protected/ automatically. The protection is baked in from the start — no admin needs to review uploads and manually run a bulk action afterwards.
The form supports both logged-in author uploads and, optionally, anonymous submissions (with Cloudflare Turnstile CAPTCHA to prevent abuse). Combined with the category-level permissions, this lets you build a workflow where contributors submit documents that are immediately protected and immediately restricted to the right audience.
Securing Existing Documents via the Bulk Action
If you have documents already uploaded before enabling secure storage, the Secure Download bulk action handles them in one pass.
On the Documents admin screen, select the documents you want to protect, open the Bulk Actions dropdown, choose Secure Download, and click Apply. Power Pack moves each document’s file into the protected folder, updates the download URL to the authenticated proxy, and reports back:
“3 documents secured. 1 document skipped (already protected). 0 documents failed.”
To help you work through a large library, the Documents screen includes a File Location column that shows the current status of every document at a glance — 🔒 Secure in green for files in the protected folder, 🔓 Public in amber for files still directly accessible. Hover over either badge to see a tooltip with more detail.
There’s also a File Location dropdown filter in the filter bar above the list. Select Public (direct access) to instantly show only the documents that still need securing. Run the bulk action on those results, refresh, and the list will be empty — all done.
Quick-Start Checklist
- Enable Secure Document Uploads globally — DLP Power Pack → Category Permissions → tick “Secure Document Uploads” — or enable it per-category on the category edit screen.
- Set View Permission to “Logged-in Users Only” on each Document Category you want to restrict.
- Place
[dlp_frontend_create]on a page to let contributors upload documents from the front end — files are secured at the point of upload. - Secure existing documents — go to the Documents screen, filter by File Location: Public, select all, and run the Secure Download bulk action.
- Confirm coverage — use the 🔒/🔓 File Location column and the filter dropdown to verify every document shows as Secure.
Together these features form a layered security model. The folder-level protection prevents anyone from guessing or scraping file URLs. The authenticated proxy enforces WordPress login and role checks on every download attempt. The category-level settings mean new uploads — whether from the admin or from contributors using the frontend form — are protected automatically, without any manual follow-up. Once configured, your document library stays locked down by default.