LH Private Uploads

Type: Plugin
Lifecycle Stage: Active

LH Private Uploads keeps private files private. WordPress normally leaves every upload in the public uploads directory, so the file behind a private post or attachment can still be fetched by anyone who has, or guesses, its URL. This plugin moves those files into a directory outside the web root and serves them through WordPress, checking who is asking before a single byte is sent.

How it works

Status decides location. When an attachment, or the post it is attached to, becomes private or password protected, the file and all its image sizes move to the private directory. When it becomes public again, they move back. Other statuses can be added with the lh_private_uploads_protected_statuses filter.
Files are served through a proxy. Protected files get a /protected-files/ URL. Each request is matched to its attachment and checked before the file is streamed, with X-Sendfile support for large files.
Access is default deny and filterable. Out of the box, editors, the file’s uploader and the author of the post it belongs to can open a private file, and password-protected files show a password form. Other plugins grant access through the lh_private_uploads_user_can_access filter.
Built for multisite. Each site keeps its private files in its own directory, mirroring the public uploads layout, and a site only ever serves its own files. Files are never overwritten when they move.

The private directory defaults to private-uploads one level above the WordPress root and can be set with the LH_PRIVATE_UPLOADS_DIR constant. There are no settings to configure.