How to set up secure client folders on your law firm website Pro

If you’ve decided an enterprise document-management system (iManage, NetDocuments, Box) is overkill and too expensive for a small firm, the next question is practical: how do you give each client their own private folder on the WordPress site you already have — one they can reach, but no one else can?

This guide is the implementation. It’s written for a solo or small firm (or the person who runs their website), and it stays honest about the boundary: a WordPress document library handles client-facing document sharing well. It is not a full DMS — there’s no matter-centric filing, no e-discovery, no email management. If you need those, this isn’t your tool. If you need "each client sees only their documents, securely, on our own site," read on.

What "secure client folder" actually has to mean

A hidden or hard-to-guess URL is not access control. If a document can be reached by anyone who has (or forwards, or leaks) the link, it isn’t secure — it’s just quiet. Real client folders need three properties:

1. Identity — the client logs in, so you know who is looking.
2. Authorisation — each client can reach their own documents and nothing else, enforced everywhere (the library, search, direct file URLs, feeds), not just hidden from the menu.
3. Protected files — the actual file can’t be downloaded by pasting its URL into a browser; access is checked at download time.

FileDeck’s client areas (a Pro feature) provide all three, and file protection makes restricted files vault so raw URLs stop working. Keep those three properties in mind — any approach that skips one isn’t secure, whatever tool you use.

Step 1 — Structure one folder per client

Model each client as a document category (e.g. "Acme Corp", "Smith v Jones"). Keep the structure flat and predictable — one category per client, matters as tags or sub-categories only if you genuinely need them. Deep nesting is where folder sprawl and misfiling start.

Displayed with FileDeck’s folder layout ([filedeck layout="folders"]), your categories render as collapsible folders, so the client sees a familiar folder view rather than a flat list.

Step 2 — Restrict each client to only their own folder

This is the security-critical step. On each client’s category, open Client area — assigned users (FileDeck) and enter that client’s WordPress username or email (any role — Subscriber is fine). The category — and every file in it — is now visible only to those users and your staff, and the restriction is enforced across libraries, search, single document pages, downloads, and WordPress’s own REST and sitemap output. It keeps being enforced even if your licence lapses.

Assignment stacks with other restrictions if you want belt-and-braces: role and password rules on the same category must all pass. For staff-side access, restrict by role so fee-earners see client folders and reception doesn’t.

Step 3 — Handle large files and external storage without breaking security

Big bundles — discovery sets, scanned files — don’t have to live in WordPress. FileDeck can point a document at a file hosted on Google Drive, Dropbox, OneDrive, SharePoint, S3 or any URL while it still appears inside the client’s folder.

One caveat to be honest about: a document that links to an external URL is only as private as that URL. If you need the file itself gated, either upload it to FileDeck (so file protection applies) or ensure the external host enforces its own access control. Don’t assume an "unlisted" Drive link is secure — it’s a hidden URL, which Step 1 warned against.

Step 4 — Give clients a simple way to find their documents

Create one page — "Your documents" — containing the [filedeck_my_documents] shortcode. Every client who logs in sees only their areas, each as a titled section with its own library; a client with nothing assigned gets a friendly empty message rather than an error. That single page serves every client, so there’s no per-client page to build or maintain.

Two touches that cut the "how do I find my file?" emails:

• Let clients send you files back. Add uploads="1" and each area gains a "Send us a document" form, locked to that client’s folder. Everything they upload lands in your moderation queue — nothing is published until you approve it.
• They’re notified automatically. When you publish a document into a client’s area, that client is emailed (via your site’s mail; use an SMTP plugin if your host can’t send). No "I’ve uploaded your engagement letter" email to write.

Step 5 — Keep a record of who accessed what

For malpractice-insurance or compliance questions, you’ll want some record of access. Be clear-eyed about what a document library gives you here:

• Downloads are counted, and with lead capture you can require a name and email before a download, which records who took what and when.
• Acknowledgments (an AI-tier feature) give a dated, per-person record of who confirmed reading a document — useful if a client must attest to receiving terms.

What FileDeck does not yet provide is a comprehensive per-user access log of the kind an enterprise DMS keeps; the full activity log records views, searches and downloads with who, when and what, exportable to CSV. If regulator-grade access logging is a hard requirement for you today, factor that in before committing.

Mistakes firms make doing this manually

• Shared Dropbox/Drive links per client. A hidden URL is not access control; links get forwarded, and there’s no log.
• One shared login for all clients. You lose identity — you can’t tell who saw what, and revoking one client means changing everyone’s password.
• No expiry or ownership. Old links live forever and no one owns the follow-up. Assign access to accounts, not URLs, so removing a client is one change.
• Assuming "unlisted" means "private." Gate the file, don’t just hide the link.

---

Set up this way, each client gets a private, access-controlled folder on your own site, files are protected at download time, and clients can find (and return) documents without a support call. FileDeck’s client areas are included in every Pro plan — see pricing. If you’re still comparing approaches, the access control overview shows how role, password, and per-user restrictions combine.