Hey Allisond,
This happened to me too. The problem is that Job Manager puts all the uploaded documents into the /wp-content/uploads folder. Because this folder is not secure out-of-the-box, you have to defend yourself from search engine crawlers and snoopers with a few security tricks:
1. Create a new robots.txt file with the following information in it:
User-agent: *
Disallow: /wp-admin/
Disallow: /wp-includes/
Disallow: /wp-content/
Put this file at the root level of your WordPress site (same folder as your wp-config.php file).
2. Put a blank or redirect index.php file in your /wp-content folder AND in your /wp-content/uploads folder. Mine looks something like this:
<?php
header('Location: https://www.myhomepage.com');
?>
This will cause web browsers to not show anything, or if it is a simple redirect, kick them out of the folder and push them to a page of your choice (like the homepage).
3. Edit your .htaccess file to require a login to view anything in the /uploads folder:
RewriteCond %{REQUEST_URI} ^.*uploads/.*
RewriteCond %{HTTP_COOKIE} !^.*wordpress_logged_in.*$ [NC]
RewriteRule . /wp-login.php?redirect_to=%{REQUEST_URI} [R,L]
This file goes a root as well, and if you have one already, just add the above code to it. I’m not sold on how well it works since I have to clear my cache to test it every time (removing the cookie), but it should add some security against snoopers.
Try those three things, and you should have your documents somewhat protected. Hopefully the next release of Job Manager will allow it to upload documents in its own, secure folder. But until then, this is what you have to do if you want to use the plugin and not have resumes show up in Google Search!
Cheers!
