Medifence – Access Control for Media Uploads

By default, every file inside the WordPress uploads directory can be opened by anyone who knows its URL. For membership sites this means that protected content pages are useless if the images inside them can still be opened directly.

Medifence puts a login check in front of every uploads request — without changing a single URL and without moving any files.

How it works

On activation, the plugin writes a small rule block into the .htaccess file inside your uploads directory (using WordPress’s own marker mechanism, so rules from other plugins are preserved). Requests for existing files are rewritten to WordPress itself, which bootstraps normally; the plugin then verifies the visitor is logged in and streams the file. No WordPress core file is ever loaded directly. Deactivating or uninstalling the plugin removes the rules, and your files are served normally again.

Features

• File URLs stay exactly the same — nothing to update in posts or the database
• Physical files stay where they are — no migration needed
• Built-in live verification: the settings screen requests a test file without a session cookie and shows the actual HTTP status anonymous visitors receive
• A warning appears on all admin screens if another plugin overwrites the rules
• Optionally require a specific capability in addition to being logged in
• Choose the denied status code (403, 404, or 401) — 404 hides that the file exists
• Optionally serve a placeholder image instead of denied images
• Exclude specific file extensions (useful when your theme loads CSS or fonts from uploads)
• Range request support for video and audio seeking, ETag-based browser caching for logged-in users
• Cleans up completely on uninstall

Requirements

• Apache or LiteSpeed with mod_rewrite enabled
• A writable .htaccess file in the uploads directory

This plugin does not work on nginx, because nginx does not read .htaccess files. The built-in live test will tell you immediately whether your server is compatible.

For developers

The final access decision can be filtered:

add_filter( 'medifence_allow_access', function ( $allowed, $file_path ) {
    // Example: always allow files inside uploads/public/.
    if ( false !== strpos( $file_path, '/uploads/public/' ) ) {
        return true;
    }
    return $allowed;
}, 10, 2 );