How to restrict document downloads to logged-in users Pro

Uploading a PDF to the WordPress Media Library makes the file itself public — anyone with the direct URL can download it, no matter how private the page that links to it looks. If you run a member area, client portal, or internal policy library, you need a real permission layer on the file, not just on the page. This guide explains why the obvious fixes fail and how to gate documents properly.

FileDeck Pro — the restriction and file-protection features in this guide are included in all Pro plans. See pricing

Why WordPress can’t do this out of the box

WordPress serves uploaded files straight from the wp-content/uploads folder as static URLs. The web server hands the file over before WordPress ever runs, so no login check, page password, or membership plugin rule is consulted. "Private" pages hide the link, not the file — the URL keeps working for anyone who has it, finds it in a search engine, or guesses the predictable /uploads/2026/07/… pattern.

The fixes that don’t work

• Password-protecting the page — protects the post content only. The file URL underneath is untouched.
• Hiding the page from menus or search — security through obscurity. The file is still indexed by search engines once any link to it exists anywhere.
• Blocking the uploads folder with .htaccess by hand — blocks everything (including images your theme needs), breaks on nginx hosts, and silently stops working after migrations.

The common thread: none of these puts a permission check between the visitor and the file.

What actually works

Two layers, used together:

1. Restrict who may download. Role restrictions limit a document category to logged-in users with the WordPress roles you choose. Visitors without an allowed role see a padlock — or nothing at all. Because permission is checked on every download request, a shared link doesn’t leak access.
2. Protect the file itself. File protection moves protected files out of the public uploads folder entirely and serves downloads through signed links that expire after 15 minutes. The old direct URL stops working — for everyone.

Layer 1 without layer 2 still leaves the raw file reachable by its original URL; layer 2 is what closes the "but they have the direct link" hole.

Set it up step by step

1. Add your documents to FileDeck (add a document) and group them into a category.
2. Go to Documents → Document Categories, edit the category, and check the allowed roles under Restrict to roles (FileDeck) — for a simple "any logged-in user" gate, check every role your site assigns, including Subscriber.
3. Enable file protection so the underlying files leave the public uploads folder and get signed, expiring download links.
4. Publish your library with the FileDeck block or shortcode as usual — restricted documents enforce the login automatically.

If your visitors don’t have WordPress accounts at all, use password protection on the category instead: one shared password, entered once per session.

Test it before you rely on it

Open a private/incognito browser window (so you’re logged out) and try both:

1. The library page — restricted documents should show a padlock or be hidden.
2. The file’s original uploads URL from before you protected it — it should no longer return the file.

If the direct URL still works, file protection isn’t active for that document yet — see the access control overview for how the pieces fit together.

FAQ

Someone already has the direct link to my PDF. Does restriction stop them?

Yes, once file protection is on: the file is moved out of the public uploads folder, so the old URL stops resolving, and the only way to download is through FileDeck’s permission-checked, expiring links.

Can I restrict some documents to specific roles and leave others public?

Yes. Restrictions are per category — keep a public category for open resources and restricted categories for member or staff documents.

Do restricted documents still show up in the library?

Your choice. By default they appear with a padlock so visitors know they exist; turn on Hide restricted documents entirely under Documents → Settings → Features to remove them from listings for anyone without access.

What about visitors who shouldn’t need an account?

Use password protection — it gates a category behind a shared password without requiring WordPress users.