Exactly what happens to a protected file — and where it stops.
Hiding a page doesn’t protect the files inside it. FileDeck Pro moves protected files into a deny-all directory and streams each download only after re-checking your permission, so a restricted file has no working public URL by default. When you need to share one deliberately, it can also issue a signed link that expires. Here’s exactly how both work — and where the limits are.
Fig. 1The three requests a protected file answers differently
01Storage
How protected files are stored.
Out of the openly served uploads folder, and into a directory your web server refuses to hand out.
When you protect a document, its file is moved out of the openly served uploads folder into a directory shielded by web-server rules (an .htaccess deny on Apache; an equivalent snippet for nginx). The file no longer has a working public URL of its own.
02Authorisation
How downloads are authorised.
Four things happen on every ordinary request, and the fourth is the one people assume rather than check.
Streamed, not linked (by default)
The file is read and streamed by FileDeck after an access check; the standard download URL isn’t a public file link.
Access checked every time
Each ordinary request re-verifies the visitor still meets the document’s rules before a byte is sent.
Default URL carries no token
The standard download link has nothing to copy or leak — access is tied to the visitor, not baked into the URL.
The raw file path is blocked
A direct request to the file itself returns 403 Forbidden, whether or not anyone is logged in — for as long as your web server honours the deny rule. Apache and most managed WordPress hosts apply it automatically; nginx needs one location block added once, and FileDeck writes the exact snippet into the protected folder for you.
03Share links
Optional: expiring share links.
A valid signed link is itself the authorisation, so treat one like the file.
Sometimes you need to send a protected file to someone who can’t log in — an auditor, a parent, a printed QR code. FileDeck can generate a signed download link that works for 15 minutes, then returns 410 Gone. Be clear on what this is: a valid signed link is itself the authorisation. During its window it lets whoever holds it download the file without logging in, and it deliberately skips the lead-capture form — that’s the point of a share link. So treat a signed link like the file itself, and only issue one when you mean to share. Any request without a valid signature still falls back to the full per-visitor access check.
04Rules
Access rules you can set.
Set on a category or a single document, and inherited by anything you add to that category later.
Password
On a category or a single document — visitors enter a password to unlock it.
Role
Restrict a category to one or more WordPress roles.
Per-document visibility
Public, logged-in users only, author only, or specific named people — an assigned document is hidden entirely from everyone else rather than padlocked.
Expiry
A document drops out of libraries and downloads after its expiry date.
05Data
What leaves your server, and what does not.
Each of these stays off until you switch it on and supply the credentials yourself.
Out of the box, nothing does. Rendering libraries, keyword search and its index, PDF thumbnails, and the files themselves are all handled on your own server, with no third party involved at all. Several optional features can talk to one, and each stays off until you switch it on and supply the credentials or the connection yourself.
Scanned-PDF OCR (Pro, off by default)
A scan is a picture of a page, so there is no text to read locally. When you enable OCR you point it at an OCR endpoint — the FileDeck OCR service, or your own instance of it — and FileDeck sends only the PDFs that have no text layer, stores the text that comes back, and keeps no copy at the service. Documents that already contain text are never sent anywhere.
AI features (AI tier, off by default)
These run on an API key you supply, so requests go to your own account with that provider under their terms. Indexing sends chunks of your document text to the embedding provider you chose (OpenAI or Voyage); the vectors it returns are stored in your own database. “Ask this library” sends the visitor’s question and the matching document snippets to your chat provider (OpenAI, Anthropic or Fireworks), with an optional setting that masks obvious personal data first. Auto summary & tags sends the document’s text to that same chat provider when you ask it to suggest metadata for a document. Ordinary keyword search is untouched by all of this and stays entirely on your server.
Storage you connect (Pro, off by default)
The cloud connectors (S3, Dropbox, Google Drive, OneDrive, SharePoint, Box) read documents from the account you connect, and vault offload mirrors protected files into your own S3 bucket so the bucket serves the download bandwidth. Both are your storage, reached with credentials you enter.
Optional integrations you connect
Bot protection verifies a completed challenge token with whichever CAPTCHA service you configure, Cloudflare Turnstile or Google reCAPTCHA; mailing-list sync sends captured lead names and emails to the provider you connected; library event webhooks POST facts about a document (title, link, file type, categories) to the URL you nominate; and GA4 events send download and search events — the document title, the search term — through the Google Analytics tag your site already runs. What they carry is metadata, not file contents.
06Limits
Honest limitations, and what deactivation does.
We describe controls precisely and let you assess them — we don’t claim FileDeck makes any organisation “compliant” with a particular standard.
Your documents and files are never deleted on deactivation. Protected files remain in their shielded directory; re-activating restores the download routing. (Uninstalling only removes data if you explicitly opt in.)
- An authorised user can always re-share a file they were legitimately given — no download system can prevent that.
- File protection is a Pro feature; the free version uses standard WordPress visibility only.
07Disclosure
Reporting a security issue.
We read every report, reply to say what we are doing about it, and credit fixes in the changelog unless you would rather stay anonymous.
- 07.1Email usFound a vulnerability in FileDeck or this site? Email support@getfiledeck.com with the details. We read every report, reply to say what we’re doing about it, and credit fixes in the changelog unless you’d rather stay anonymous. Please give us reasonable time to ship a fix before publishing details. Machine-readable version: /.well-known/security.txt.
08See it working
The demo runs the real access checks.
Paste a protected file’s direct URL into a private window and watch it return 403. That is the check worth running against every plugin you consider, ours included.
See file protection working in the live demo, or read how access rules are set in the admin walkthrough on the home page.