How to Configure Prevent File Access / Media Restriction for WordPress?

Premium Features With Configuration Steps

Step 1: File Restriction

This feature allows you to restrict the files from the website based on their extension for the website's public users (non-logged-in users).

Follow below steps to configure this feature:

• Write the file extension in the mentioned field which you want to restrict on your website:

• Click Save Settings button.
• Click on the Show Rules button and select the tab corresponding to your server, you will find the required rules there, and update the rules in the corresponding file.

Apache: We need to update the rules in .htaccess file

Nginx: We need to update rules in nginx.config.

Step 2: Protected Folder

If you are looking to restrict only some selected files then you can put them in protected folder and selected files will be protected from public access.

Follow below steps to configure this feature:

• Go to the Protected Folder tab in the plugin.
• Click on Choose file → Select the file to restrict from your system → Click on Upload.

• The file will be listed in the restricted files list.

• Click on the Show Rules button and select the tab corresponding to your server, you will find the required rules there, update the rules in corresponding file.
• A folder with the name protectedfiles will be created in uploads folder and files in this folder will be restricted from the public user and only logged-in user will be able to access it.
• You can remove files by clicking on Delete button.

Step 3: Uploads Folder Restrictions

This feature allows you to restrict access to the complete uploads folder or any subfolder in the uploads folder. You can also select multiple folders inside the Uploads folder and they all will be restricted from public access.

Follow below steps to configure this feature:

• Go to the Folder Restriction tab in the plugin.
• Click the folders that you want to restrict, you can click on the icon (+) to expand or compress the corresponding folder.
• Click the Save Settings button.
• Click on the Show Rules button and select the tab corresponding to your server, you will find the required rules there, and update the rules in the corresponding file.

Step 4: Custom Folder Restriction

This feature allows you to restrict access to any folder in WordPress instance. You just need to enter the folder name and all the files in that folder will be restricted.

Follow below steps to configure this feature:

• Go to the Folder Restriction tab in the plugin.
• Enter the folder name in WP Custom Folder to restrict: field.

• Click the Save Settings button.
• Click on the Show Rules button and select the tab corresponding to your server, you will find the required rules there, and update the rules in the corresponding file.

Whitelist Folder Paths

Use Directly Accessible Media Folders to whitelist specific folder paths so media files in those folders remain publicly accessible without authentication, even when folder restrictions are enabled.

Follow below steps to configure this feature:

• In the Folder Restriction tab, go to the Directly Accessible Media Folders section.
• Turn on Enable direct access whitelist using the toggle button.
• Enter the folder paths in the Whitelisted folder paths: field. Enter one folder path per line (for example, /wp-content/uploads/2026/07).
• Click the Save Folder Paths button.

Step 5: Role-based Folder Restriction

You can use this feature to restrict access to folders based on WordPress roles. Enable role-based restriction and enter the allowed folder name for each role in the ROLE / ALLOWED FOLDER table. Only users with that role (and Administrators) will be able to access the assigned folder.

Follow below steps to configure this feature:

• In the plugin, click the Folder Restriction tab. Turn on Enable role-based restriction using the toggle button.
• On enabling, the Role-based Folder Restriction section will open with a ROLE and ALLOWED FOLDER mapping table, as shown in the image below.
• Enter the folder name in the ALLOWED FOLDER field for each role that should have access to that folder.

• Administrator can access all folders by default. Enter a folder name in the Administrator ALLOWED FOLDER field only if you want to restrict that folder exclusively to admins.
• The additional folder will only be accessed by users with the Editor role (except Administrator).
• The 06 folder will only be accessed by users with the Author role (except Administrator).
• Roles with an empty ALLOWED FOLDER field (for example, Contributor and Subscriber) are not assigned a restricted folder.
• You can also assign multiple folders to a role. Write the folder names separated by a comma. For example, if you want Editor to have access to additional, 06, and uploads, write additional, 06, uploads in the field corresponding to Editor.
• Click the Save Settings button.
• Click on the Show Rules button and select the tab corresponding to your server, you will find the required rules there, and update the rules in the corresponding file.

Step 6: User-Based Folder Restriction

You can use this feature to restrict access to certain folders only to certain users.

Follow below steps to configure this feature:

• Go to the Folder Restriction tab in the plugin.
• Click on the toggle button in User base Folder Restriction. On toggling, the User base Folder Restriction section will be enabled.
• Click on the Show Rules button and select the tab corresponding to your server, you will find the required rules there, and update the rules in the corresponding file.

• Now go to the Users table in the WordPress admin dashboard and Edit profile of the user whom you want to give access to particular folder.

• Scroll down in the user's profile and you will get a Folder Access section.

• Enter the folders that can only be accessed by the particular user.

• Click on Update User button.

Step 7: Redirection Options

This feature provides multiple redirect options for the file restricted i.e. if the user doesn't have the access to a file then they will be redirected to that particular redirect option.

Follow below steps to configure this feature:

Display Custom Page

• If user is not allowed to access any file/folder then you can redirect to any page of your WordPress site.
• Go to the File Restriction tab of the plugin.
• Under the Redirect Option: section, select Display Custom Page.
• Under the Redirect to: section, list of all the pages in your WordPress site will be displayed. Select any page where you want to redirect non-logged in user.
• Click the Save Settings button.
• Click on the Show Rules button and select the tab corresponding to your server, you will find the required rules there, and update the rules in the corresponding file.

Redirect to WordPress login

• This option will redirect a non-logged in user trying to access a restricted file or folder to WordPress login page (wp-login.php).
• Go to File Restriction tab of plugin.
• Select Redirect to WordPress login option under Choose Redirect Option:
• Under Redirect to you will get WordPress login.
• Click the Save Settings button.
• Click on the Show Rules button and select the tab corresponding to your server, you will find the required rules there, and update the rules in the corresponding file.

Redirect to SSO login

• This option will redirect non-logged in user trying to access restricted file or folder to IDP login page. If you have configured OAuth SSO plugin then user will be redirect to login page of first configured OAuth/OpenID provider, if you have configured SAML SSO plugin then user will be redirected to login page of first configured IDP.
• Go to File Restriction tab of plugin.
• Select Redirect to SSO login option under Choose Redirect Option:
• Under Redirect to option select OAuth SSO login or SAML SSO login based on the SAML/OAuth SSO plugin you're using.
• Click the Save Settings button.
• Click on the Show Rules button and select the tab corresponding to your server, you will find the required rules there, and update the rules in the corresponding file.

Step 8: Media Management

Provides administrators with granular control over uploaded files, media directories, and user access permissions.

• Folder & File Level Protection: Restrict access to specific media items, file categories, or entire uploads directories based on user roles or login status.
• Bulk Media Permissions: Apply security rules across multiple files or folders simultaneously to streamline management.
• Dynamic Access Control: Enable or disable media protection on-demand without moving files physically on the server.
• Role-Based Visibility: Specify which user roles (e.g., Administrator, Editor, Subscriber, Custom Roles) can view, stream, or download restricted media files.
• Media Upload Control: Enable or disable media uploads to control whether users can add new files to the media library.

Step 9: User Analytics

Offers detailed insights and tracking for media consumption, asset usage, and file download activity.

• Real-Time Access Logs: Track user activity including user ID, IP address, file requested, timestamp, and HTTP response code.
• Download & View Tracking: Monitor top-accessed files, total download volume, and peak traffic periods.
• User-Level Insights: View individual user history to audit media usage and identify potential credential or link sharing.
• Exportable Reports: Generate and export CSV/Excel activity logs for compliance, security auditing, and performance analysis.

Step 10: IP-Based Restriction

Enforces perimeter network controls to prevent unauthorized access, hotlinking, and web scraping by IP address or range.

• IP Whitelisting & Blacklisting: Allow or block specific IP addresses or subnets (CIDR ranges) from reaching protected media files.
• Hotlink & Direct Access Protection: Block external domains and direct URL access unless traffic originates from authorized sources or IP ranges.
• Geo/Network Policy Enforcement: Safeguard internal assets by restricting file downloads exclusively to corporate networks or specific IP blocks.
• Automated Threat Mitigation: Temporarily block IP addresses exhibiting suspicious burst access patterns or repeated unauthorized download attempts.