Protect files on nginx servers Pro

FileDeck’s file protection blocks direct access to protected files automatically on Apache using a .htaccess rule. nginx does not read .htaccess files at all, so on nginx servers you need to add one short location block to your server configuration. It takes a minute and only has to be done once.

FileDeck Pro — this feature is included in all Pro plans. See pricing

Why nginx needs this step

Apache reads .htaccess files placed inside folders and applies their rules on the fly, which is how FileDeck locks down wp-content/uploads/filedeck-protected/ automatically. nginx ignores .htaccess by design — all rules live in the central server configuration — so the equivalent rule has to be added there by you or your host.

The location block to add

1. Open your site’s nginx configuration (often a file under /etc/nginx/sites-available/ or a per-site config your host provides).

2. Inside the server { ... } block for your site, before any generic static-file rules, add:

   location ~* /uploads/filedeck-protected/ {
       deny all;
   }
   

3. Reload nginx to apply the change, for example with sudo systemctl reload nginx.

This denies all direct requests to the protected folder. Downloads are unaffected because FileDeck serves protected files through its own endpoint (/fdk-download/{id}) with signed, short-lived URLs — never from the folder directly.

On managed WordPress hosting

Many managed hosts do not expose the nginx config directly. Some provide a custom-configuration file or dashboard field; otherwise, open a support ticket. Wording you can paste:

Please add the following location block to the nginx configuration for my site so that direct requests to my protected uploads folder are denied:

location ~* /uploads/filedeck-protected/ { deny all; }

Hosts handle requests like this routinely.

How to verify protection is working

1. Restrict a document in FileDeck so its file moves into the protected folder.
2. In a logged-out browser (or a private window), try to open the file’s direct URL under https://yoursite.com/wp-content/uploads/filedeck-protected/.... You should get a 403 Forbidden response.
3. Back in the library, download the same document as a visitor who has permission. The download should succeed normally.

If the direct URL returns a 403 and the library download works, protection is fully in place.

FAQ

How do I know whether my site runs nginx or Apache?

Go to Tools → Site Health → Info in wp-admin and check the server section, or ask your host. Many managed WordPress hosts run nginx.

The direct URL still serves the file — what now?

The block has not taken effect. Confirm it sits inside the correct server block before generic static-file rules, reload nginx, and clear any CDN or page cache. On managed hosting, confirm with your host that the change was applied.

Do I need this on Apache?

No. FileDeck configures Apache automatically via .htaccess. This step is only for nginx.

Will this block legitimate downloads?

No. Permitted visitors download through FileDeck’s signed URLs, which never touch the folder path directly. Only raw direct-URL access is denied.