Restrict documents by role Pro

FileDeck Pro can limit the documents in a category to logged-in users with the WordPress roles you choose. You set this with the Restrict to roles (FileDeck) checkboxes on the category edit screen; visitors without an allowed role see the documents with a padlock — or not at all, if you prefer. Unlike a shared password, access follows the user account.

FileDeck Pro — this feature is included in all Pro plans. See pricing

How to restrict a category by role

1. Go to Documents → Document Categories and edit the category.
2. Under Restrict to roles (FileDeck), check each role that should have access: Administrator, Editor, Author, Contributor, or Subscriber.
3. Leave all boxes unchecked to keep the category public.
4. Save. The restriction covers every document in the category.

A restricted category covers everything inside it, including documents you add later — one setting, one place to change it.

What visitors without access see

By default, restricted documents still appear in listings with a padlock, so visitors know the document exists but cannot download it without logging in with an allowed role. To remove restricted documents from listings entirely, turn on Hide restricted documents entirely under Documents → Settings → Features. Either way, permission is checked on every download request, so shared links do not leak access.

Working with membership plugins

If your membership plugin assigns members a standard WordPress role — many give members Subscriber — role restriction works with it out of the box:

1. Check which role your membership plugin assigns (its settings usually show this).
2. Check that role under Restrict to roles (FileDeck) on your categories.
3. When a membership lapses and the plugin removes the role, access to the documents ends automatically.

Protect the files too

Role restriction controls the library and the download endpoint. To make sure the underlying files cannot be fetched at their direct URLs, FileDeck’s file protection moves protected files out of the public uploads folder and serves them through signed links that expire after 15 minutes.

Test the restriction properly

"It looks restricted to me" is not a test — you’re probably logged in as an administrator, and administrators see everything. Check all three states:

1. Logged out (a private/incognito window): the restricted documents should show a padlock — or be absent, with Hide restricted documents entirely on — and the download button should refuse.
2. Wrong role (a test account with a role you did not allow): same result as logged out.
3. Right role: the documents list and download normally.

Then try the one attackers try: paste a restricted file’s direct URL into the logged-out window. With file protection active it should refuse — if the raw file loads, your server is serving the protected folder directly; see file protection (nginx needs one extra rule).

Common mistakes

• Testing as an administrator. Managers bypass every restriction by design. Always test with a real subscriber-level account.
• Page caching serving a member’s page to everyone. Restriction is enforced on every download request, so files never leak — but a full-page cache can show restricted listings (titles) rendered for a logged-in user to logged-out visitors. Exclude your library pages from full-page caching, or configure your cache to vary by login state (most hosts’ caches already skip logged-in traffic).
• Restricting the page instead of the documents. Hiding the page that lists documents does nothing to the documents themselves — they remain reachable through search and direct links. Restrict the category; FileDeck then enforces it everywhere, including WordPress’ own search, feeds and REST API, so restricted titles don’t leak through site search either.
• Sharing a "temporary" raw file link. Use FileDeck’s signed share links instead — they carry their own expiry.

FAQ

Do visitors need a WordPress account?

Yes. Role restrictions apply to logged-in users. For visitors without accounts, use password protection instead.

Can I hide restricted documents instead of showing a padlock?

Yes. Turn on Hide restricted documents entirely under Documents → Settings → Features and restricted documents disappear from listings for anyone without an allowed role.

Does this work with my membership plugin?

If your membership plugin assigns members one of the standard WordPress roles — most do — then yes. Restrict categories to that role and access tracks membership automatically.

Can I see who downloaded a restricted document?

Yes. Turn on Log activity under Documents → Settings → Features, and the log under Documents → Activity Log records who downloaded what and when.