Hi,
I’m just a regular user (not UM Support) but I’m guessing that since UM Content Restriction can only apply to Posts, Pages, and Media in the WordPress environment (as set in Ultimate Member -> Settings, Access tab), it will only restrict the attachment page, and not the PDF itself.
I tested this with my site – I had a PDF in Media, I clicked it, then clicked “Edit more details”, then went to UM Content Restriction and clicked “Restrict access to this content?”. I chose “Logged In Users” for “Who can access this content?” and kept all the default settings.
The PDF still loads if the URL is used directly, just like you. However, if I use the Attachment page (the permalink), then access is restricted and I get the “Whoops” restriction message when I visit the page without a user logged in.
This makes sense only because when the PDF is accessed directly, WordPress doesn’t even load. Therefore, UM can’t load, and it can’t restrict your content.
In order to do what you want, I think you would have to look for an alternate solution that works with the file system directly.
I do not know of one, but a Google search took me to this link: (at your own risk)
https://barn2.co.uk/restrict-wordpress-attachment-files-access/
…which may allow you to find a way. The article also explains the “loophole” which is allowing for the direct link access you’re trying to prevent.
Hope that helps!
