True file protection: how signed download links work Pro

By default, every file in the WordPress uploads folder is publicly reachable at its direct URL — even if the page linking to it is password-protected or members-only. FileDeck Pro closes that gap: protected files are moved out of the public uploads area, direct access to them is blocked, and downloads are served only through signed URLs that expire after 15 minutes, issued only to visitors who pass the permission check.

FileDeck Pro — this feature is included in all Pro plans. See pricing

The problem with normal WordPress uploads

WordPress stores uploads as plain files under wp-content/uploads/, and the web server hands them to anyone who knows the URL. Protecting the page does nothing for the file itself: a leaked link, a shared bookmark, or a search engine that has indexed the URL all bypass your page-level restrictions. For genuinely private documents, the file itself has to be protected.

How FileDeck protects the file

When you restrict a document with FileDeck’s access control, the file is handled differently from a normal upload:

1. The file is moved into wp-content/uploads/filedeck-protected/, a folder blocked from direct access.
2. Downloads go through FileDeck’s endpoint (/wp-json/filedeck/v1/download/{id}), which serves the file only to a visitor who passed the permission check.
3. If the visitor is allowed, the file is streamed with a signed, short-lived token. The signed URL expires after 15 minutes.

For a visitor who passes the permission check, the library’s download button carries a signed link made when the page loads, and it expires 15 minutes later.

That link stands in for the visitor’s own permission check. Lead capture, terms acceptance, a form or bot check, hotlink protection and daily download limits apply to it as they do to any other download. A share link you create yourself, a single-use link or a transmittal, is what skips them.

What this means in practice

• Shared or leaked links die quickly. A signed URL stops working 15 minutes after it was issued, and getting a fresh one requires passing the permission check again.
• Direct file URLs never work for protected documents. There is no public path to the file to guess or bookmark.
• Search engines cannot index protected files. There is nothing publicly fetchable to crawl.

Server requirements

On Apache, FileDeck sets this up automatically with a .htaccess rule — nothing to configure. On nginx, .htaccess files are ignored, so you need to add one short config snippet; see protect files on nginx servers for the exact block and how to verify it.

FAQ

What happens if someone shares a download link?

A signed link works for whoever holds it until it expires, 15 minutes after the page was loaded; after that, getting a fresh one means passing the permission check again. So a shared link does not grant lasting access. To hand one file to one person without an account, use a single-use download link.

Can Google index my protected files?

No. Protected files live in a blocked folder and are only ever served through short-lived signed URLs, so there is no stable public URL to index.

Do I need to configure anything on Apache?

No. FileDeck writes the required .htaccess rule automatically. Only nginx needs a manual snippet.

Does inline preview still work for protected files?

Yes. Preview loads protected documents through a signed link too, so permitted visitors can preview them normally. The download gates (lead capture, terms, the form and bot checks, daily download limits) apply to downloads, not to previews. Protected Office documents are the exception — rendering them would require handing the file to an external viewer service, so they offer a download button instead.