Restrict Uploads Folder Via Htaccess…
-
I am creating a very small members only website. I thought the blocking off part of it would be pretty simple as there are many plugins and WordPress has some built in functions.
However, the one thing I didn’t really think about was that the uploads folder would be hanging out there still with anybody that might have a direct link (even if the chance is low).
I’ve been researching the htaccess file to achieve this and came across the below. It tested it and it seems work.
It uses the wordpress logged in cookie to check if they are logged in. Any thoughts on how solid of a solution this is?
<IfModule mod_rewrite.c> RewriteEngine On RewriteCond %{HTTP_COOKIE} !.*wordpress_logged_in.*$ [NC] RewriteCond %{REQUEST_URI} ^(.*?/?)wp-content/uploads/.* [NC] RewriteRule . https://%{HTTP_HOST}%1/wp-login.php?redirect_to=%{REQUEST_URI} [L,QSA] </IfModule>
-
Thanks. I saw the wpbeginner article and it has parts of what I need to do to make it secure like hotlinking etc.
However, I still am missing the best way to restrict access to assets in the uploads folder when a person is not logged in but the direct link is still accessible publicly.
I saw another Stackoverflow article that recommends doing this via PHP. However, there is literally dozens of people on github over 4 years trying to figure out the best way to do this. I never thought it would be so complicated! Maybe i’m not thinking about this correctly.
I am leaning towards using wordpress_logged_in as the cookie might be hackable, but for this use case it would be really hard I think.
- The topic ‘Restrict Uploads Folder Via Htaccess…’ is closed to new replies.