How to choose and set up a WordPress download manager with access control Pro

A WordPress download manager with access control does two jobs. It decides who may download each file, by login, role, password, named person or link, and it stops the file being fetched any other way. The second job is the one to check, because WordPress serves uploads to anyone who has the file’s URL, and a download button behind a login does not protect a file that still has a public address.

This guide sets out what to check before choosing one, compares the common approaches, and shows how to set it up with FileDeck.

What access control does a download manager need?

Work through these questions with your own files in mind. Each is a separate feature, and a plugin can have some without the others.

1. Who can download? Logged-in users, chosen roles, named people, a company by email domain, holders of a membership plan, or anyone with a password.
2. Is the file itself protected? Copy a restricted file’s download address, open it in a private browsing window, and see whether the file arrives. If it does, the restriction only covers the button.
3. Can a link be passed on? A download link with no expiry can be forwarded. Expiring links, and links that work once, limit what a forwarded link is worth.
4. Can you limit how much is taken? A daily download ceiling per role, an expiry date on a document, a cap on how many times it can be downloaded, an IP range, or a bot check in front of the download.
5. Do people agree to anything first? Licence terms, a disclaimer, or a name and email address before the file is served.
6. Do you know who downloaded what? A lifetime count per file is the minimum. A log names the signed-in person and the time, and an alert can tell you as it happens.
7. What happens when the licence lapses? If restricted files become public when a paid licence expires, you were renting the protection rather than owning it.

Why doesn’t WordPress do this on its own?

WordPress stores uploads under wp-content/uploads, and the web server answers requests for them directly, before WordPress loads. No login, role or password check takes place. Private pages and members-only pages built with a membership plugin lock the page, not the files linked from it, unless the plugin also protects the files. See how to stop direct URL access to files in WordPress uploads for how to check your own site.

What are the options?

Approach	Decides who can download?	Protects the file itself?	Trade-off
A members-only or password-protected page	Yes, for the page	No	The files linked from the page stay public
A membership plugin’s content rules	Yes	Only if the plugin also protects files	Built around memberships and payments rather than a library of documents
A download manager or document library plugin with access control	Yes	Yes, when it moves the file out of public reach	Needs one server rule on nginx
Cloud-storage sharing links	Depends on the provider’s sharing settings	Only when shared with named accounts	The files and the access rules live outside your site

For a set of files that people come back to, you want a plugin that answers all seven questions: one place to set the rules, files that cannot be fetched around them, and a record of what was taken.

Access controls in FileDeck

FileDeck’s free plugin publishes, searches and counts downloads. The access controls are part of FileDeck Pro, with a few on the AI plan.

FileDeck Pro — every control marked Pro below is included in all Pro plans, from $59/yr for one site. PDF watermarking and view-only documents are on the AI plan. See pricing

Question	Control	Plan
Who can download?	Role restriction on a category	Pro
	Password on a category or a single document	Pro
	Specific people only, client areas, groups and email-domain access	Pro
	Membership plans: MemberPress, Paid Memberships Pro, WooCommerce Memberships, Restrict Content Pro or s2Member	Pro
Is the file protected?	File protection: restricted files move to a protected folder and download through signed links that expire after 15 minutes	Pro
Can a link be passed on?	Single-use links that work for one download and lapse after 7 days if unused	Pro
	Hotlink protection against other sites embedding your download links	Pro
How much can be taken?	Download quotas: a daily ceiling per role and for logged-out visitors, or a cap on downloads per document	Pro
	Document expiry after a date, and IP rules for office or VPN ranges	Pro
	Bot protection with Cloudflare Turnstile or Google reCAPTCHA	Pro
Agree to anything first?	Terms before download, lead capture, or a form from your form plugin	Pro
Who downloaded what?	Download counts per document	Free
	The activity log with names for signed-in users and CSV export, and download notifications by email or webhook	Pro
	PDF watermarking with the recipient’s email and the time	AI plan
When the licence lapses?	FileDeck falls back to the free version and keeps enforcing access rules, so restricted documents stay restricted. See licensing	All plans

How to set up access-controlled downloads with FileDeck

1. Publish the library. Install FileDeck from WordPress.org, upload your files as documents, file them in categories, and add the Document Library block to a page. This part is free. See how to create a document library in WordPress.
2. Choose a rule per category.

   Pro — edit a category under Documents → Document Categories and set the rule that fits: Restrict to roles (FileDeck), Password protect (FileDeck), or the client-area fields for named people, groups, email domains and membership plans. A rule on a parent category covers the categories beneath it. Use a single document’s own settings for exceptions.

3. Confirm the files are protected.

   Pro — as soon as a document is restricted, FileDeck moves its file into a folder blocked from direct access and serves it through signed links. On Apache the blocking rule is added automatically; on nginx, add the short location block in protect files on nginx servers.

4. Add limits if you need them.

   Pro — set download quotas, expiry dates, IP rules or a bot check. Quotas work alongside the access rules: they limit how much an allowed person can take, and they do not let anyone in.

5. Turn on the record.

   Pro — enable Log activity under Documents → Settings → Features. The log is under Documents → Insights → Activity log.

6. Test as a visitor. Open the library in a private browsing window. Restricted documents should show a padlock, or not appear at all if you chose to hide them. A download should be refused, and the file’s old uploads address should no longer return the file.

What do visitors without access see?

For role- and password-restricted documents, a padlocked row by default, so people know the document exists and can ask for access. Tick Hide restricted documents entirely under Documents → Settings → Features to leave them out instead. Documents in a client area or given to specific people are left out of everyone else’s library without a padlock, because a locked row would still reveal the title.

FAQ

Does a members-only page protect the files on it?

No. It hides the page. The files linked from it keep their public addresses in wp-content/uploads, and anyone with an address can download the file unless a plugin moves it out of public reach.

Is there a free WordPress download manager with access control?

FileDeck’s free plugin covers the library and download counts, with no limit on documents. The access controls, including file protection, are in FileDeck Pro from $59 a year for one site, with renewals at the same price.

Can I limit how many times someone downloads a file?

Yes, with FileDeck Pro download quotas. Set a daily ceiling for each role and for logged-out visitors, or let a single document expire after a set number of downloads.

Can I restrict downloads to members of a paid plan?

Yes. FileDeck Pro reads plans from MemberPress, Paid Memberships Pro, WooCommerce Memberships, Restrict Content Pro and s2Member, so access follows the membership. See membership plans.

Can I see who downloaded a file?

For signed-in users, yes: the Pro activity log records the person, the document and the time, with CSV export. Downloads by visitors who are not signed in are counted but cannot be named; ask for a name and email first with lead capture if you need one.

What happens to protected files if my licence expires?

FileDeck falls back to the free version, your documents and settings stay in place, and access rules are still enforced, so restricted documents do not become public. The Pro features and updates stop until you renew.

Next steps

See the library on the live demo, then read the access control overview to pick a method. For narrower jobs, see how to password-protect downloads, how to restrict downloads by user role and how to track file downloads. Our security page sets out how file protection behaves and where its limits are.