Language Help Secure PDF WP Registry grade A. No security issues foundWP RegistryNo security issues foundOpen the reportA

A small WordPress plugin that serves files through permanent secret links instead of their real URLs. Built for delivering lead magnets (like a PDF promised in a welcome email) without exposing a guessable /wp-content/uploads/ path.

What it does

• Protects any Media Library file in place — nothing is copied or moved. A per-file .htaccess deny rule (<Files> Require all denied) blocks the file's direct URL while PHP can still read it.
• Serves each protected file at https://yoursite.com/download/<64-character-secret-key> with no-cache and noindex headers, optionally under a different download filename than the one in the library.
• Because there is only one copy, updating the file is just replacing it in the Media Library — the secret link keeps serving the current content.
• Wrong or revoked keys get a plain 404 — no hint that the endpoint exists.
• Each file has its own key, download counter, and enable/disable switch.
• Links are permanent until you regenerate them. Regenerating kills the old link instantly. Removing protection restores normal public access.
• Links issued by v2 (/pdf-download/..., served from wp-content/private-pdf-downloads/) continue to work.

What it does not do

• Links are not tied to an email address. Anyone holding the link can download the file. For a free lead magnet that trade-off is usually fine; for paid products it is not.
• No expiry, no one-time links, no login requirement.

Install

Download lh-secure-pdf.zip from the latest release and upload it via Plugins → Add New → Upload Plugin.

Use

1. Upload your file to the Media Library as usual.
2. Open the file in the Media Library, optionally type a different download name for visitors, and click Protect & generate link. (Settings → Secure PDF lists and manages all protected files.)
3. Copy the secret link and paste it wherever it's needed (your email autoresponder, etc.).
4. To update the file later, replace it in the Media Library — same link, new content. To retire a link, use Regenerate, Disable, or Remove on the settings page.

Updates

During WordPress's normal update checks (via the Update URI plugin header), the plugin reads manifest.json from this repo's main branch over raw.githubusercontent.com. When the manifest's version is newer than the installed one, the update appears on the Plugins screen like any other, installing the zip the manifest points at. Enable auto-updates for the plugin if you want them applied without clicking. There is also a Check for updates now button on Settings → Secure PDF that bypasses all caches.

raw.githubusercontent.com is used instead of the GitHub REST API because the API's unauthenticated rate limit (60/hour per IP) is shared with every other site on a shared-hosting server's IP.

Release process: bump Version: and LHSP_VERSION in the plugin, set the same version and the release asset URL in manifest.json, commit, push, then publish a GitHub release for that tag with the built lh-secure-pdf.zip attached.

Notes for Nginx hosts

The per-file .htaccess deny rules only work on Apache/LiteSpeed. On Nginx, blocking direct access needs equivalent location rules in the server config for each protected file (or a shared naming convention you can match on).

License

GPL-2.0-or-later, like WordPress itself.