True file protection: how signed download links work Pro

By default, every file in the WordPress uploads folder is publicly reachable at its direct URL — even if the page linking to it is password-protected or members-only. FileDeck Pro closes that gap: protected files are moved out of the public uploads area, direct access to them is blocked, and downloads are served only through signed URLs that expire after 15 minutes, with permission checked on every request.

FileDeck Pro — this feature is included in all Pro plans. See pricing

The problem with normal WordPress uploads

WordPress stores uploads as plain files under wp-content/uploads/, and the web server hands them to anyone who knows the URL. Protecting the page does nothing for the file itself: a leaked link, a shared bookmark, or a search engine that has indexed the URL all bypass your page-level restrictions. For genuinely private documents, the file itself has to be protected.

How FileDeck protects the file

When you restrict a document with FileDeck’s access control, the file is handled differently from a normal upload:

1. The file is moved into wp-content/uploads/filedeck-protected/, a folder blocked from direct access.
2. Downloads go through FileDeck’s endpoint (/fdk-download/{id}), which checks the visitor’s permission on every request.
3. If the visitor is allowed, the file is streamed with a signed, short-lived token. The signed URL expires after 15 minutes.

The visible download link in your library never changes — the signing happens behind the scenes each time a permitted visitor downloads.

What this means in practice

• Shared or leaked links die quickly. A signed URL stops working 15 minutes after it was issued, and getting a fresh one requires passing the permission check again.
• Direct file URLs never work for protected documents. There is no public path to the file to guess or bookmark.
• Search engines cannot index protected files. There is nothing publicly fetchable to crawl.

Server requirements

On Apache, FileDeck sets this up automatically with a .htaccess rule — nothing to configure. On nginx, .htaccess files are ignored, so you need to add one short config snippet; see protect files on nginx servers for the exact block and how to verify it.

FAQ

What happens if someone shares a download link?

The library’s download link only works for visitors who pass the permission check, and any signed URL they copy expires after 15 minutes. Either way, the shared link does not grant lasting access.

Can Google index my protected files?

No. Protected files live in a blocked folder and are only ever served through short-lived signed URLs, so there is no stable public URL to index.

Do I need to configure anything on Apache?

No. FileDeck writes the required .htaccess rule automatically. Only nginx needs a manual snippet.

Does inline preview still work for protected files?

Yes. Preview uses the same signed-URL mechanism under the hood, so permitted visitors can preview protected documents normally.