Access control overview Pro

FileDeck Pro lets you restrict documents by WordPress role or by a shared password. Both restrictions are set per category on the category edit screen. For anyone without permission, a restricted document shows with a padlock in libraries by default — or can be hidden entirely — and its download is blocked.

FileDeck Pro — this feature is included in all Pro plans. See pricing

How the access control model works

There are three category-level restriction methods:

• Password — anyone who enters a shared password can view and download. Visitors do not need an account. See password protection.
• Role — only logged-in users with an allowed WordPress role can access the documents. You tick the roles to allow: Administrator, Editor, Author, Contributor, or Subscriber; leaving all unchecked keeps the category public. See role restrictions.
• Client area — the category is assigned to named people, and only they see it. See client areas.

All three are set on the category edit screen: go to Documents → Document Categories, edit a category, and use the Restrict to roles (FileDeck) checkboxes, the Password protect (FileDeck) field, or Client area — assigned users (FileDeck). Role and password restrictions padlock documents in listings by default; client-area documents are hidden from everyone except their assigned users.

There is also a per-document control. In the Document File box on any document, Visibility offers four options:

• Public
• Logged-in users only
• Author only
• Specific people only — pick the individuals who get it. See assign a document to specific people.

The first three padlock the document for anyone who fails them. "Specific people only" does not: the document is removed from everyone else’s library entirely, because these are usually somebody’s private files and a locked row showing the title would disclose them.

A single document can also carry its own password, using WordPress’s own Password protected visibility — the download route and the vault both honour it. See password protection.

Sub-categories inherit their parent’s restriction

Categories are hierarchical, and a restriction applies to the whole branch beneath it. If you restrict Clients and file a document in Clients → Acme Corp, that document answers to the restriction on Clients even though the sub-category carries no rule of its own — and Acme Corp itself stops appearing in category lists and dropdowns for anyone who cannot see Clients.

Set the rule at the highest level that should be protected. To make something more widely available, move it to a category outside that branch rather than to a child of it — a sub-category is never less restricted than its parent.

What a restriction actually does

Restriction is not just a hidden link. For anyone without permission, a restricted document:

• appears with a padlock in the table, grid, gallery and folders layouts by default, so visitors know it exists but is restricted;
• can instead be removed from libraries completely — turn on Hide restricted documents entirely under Documents → Settings → Features;
• cannot be downloaded — the download endpoint checks permission on every request, so a shared or bookmarked download link is refused.

Assigning a document to named people

Everything above works by category or by role. A document can also be given to named individuals — see assign a document to specific people. It is the one restriction that hides the document completely rather than showing a locked row, because these are usually somebody’s private files and the row title alone would disclose them to everyone else.

Which method should you pick?

• Semi-public documents (board packs, member newsletters) where visitors have no site accounts: use a password. Everyone shares it, so treat it as light protection.
• Groups of logged-in users (staff, members, clients): restrict by role.
• If you are unsure, prefer role restriction — passwords can be forwarded, accounts cannot.

Pair restrictions with file protection

Access control governs what appears in the library and who can use the download endpoint. FileDeck Pro also protects the files themselves: protected files are moved out of the public uploads area and served only through signed links that expire after 15 minutes, so direct file URLs never work. Read how signed download links work. On nginx servers, add the one-line config from protect files on nginx servers.

FAQ

Do restricted documents show up in the library search?

By default, yes — they appear with a padlock so visitors know they exist but need permission. Turn on Hide restricted documents entirely in Documents → Settings → Features to remove them from listings and search for anyone without access.

Can someone with a direct download link get a restricted file?

No. Permission is checked on every download request, and with file protection enabled the file’s direct URL is blocked as well.

Which method is best for a membership site?

Role restriction, if your members are logged-in users with one of the standard WordPress roles (Subscriber, for example). If your members do not have site accounts, use password protection.

Is access control available in the free version?

No. Access control and file protection are Pro features — see free vs Pro.