Tomatillo Design ~ Protected Media
Protects specific media files, hand-selected in the Media Library, so only logged-in users can access them via a secure endpoint.
by Chris Liu-Beers · github.com/tomatillodesign/tomatillo-design-protected-media
Install
No release zip yet. The repository archive installs, but the folder name will carry the branch suffix and updates will not flow:
wp plugin install https://github.com/tomatillodesign/tomatillo-design-protected-media/archive/refs/heads/main.zipReadme
Tomatillo Protected Media
Protects specific media files (like PDFs) so only logged-in users can access them via a secure WordPress endpoint. Lightweight and simple to use.
⚠️ Disclaimer
This plugin does not physically restrict access to files stored in /wp-content/uploads/. Files are still publicly accessible via their original URLs unless your server is configured to block them. For stronger protection, use .htaccess (Apache) or nginx rules to deny direct access to protected files.
Users are fully responsible for their own media security. Always consult a security expert if you handle sensitive content.
✅ Features
- "Protect this file" checkbox added to Media Library.
- Protected files are served through randomized, tokenized URLs like
/protected-file-3xtmsgst/. - Files only load for logged-in users.
- REST API hides protected media from public queries.
- No database bloat, no UI clutter.
- Works across most hosts (Apache or nginx).
🚀 Usage
- Install and activate the plugin.
- Go to Media Library > Edit Attachment.
- Check “Protect this file” to secure a file.
- The original file URL will be replaced with a secure link that only works for logged-in users.
- Visitors will be redirected to the login page if not authenticated.
🔐 Example
Before:
/wp-content/uploads/2025/06/report.pdf
After protection:
/protected-file-a1b2c3d4
Only logged-in users can access the new URL. Bots, guests, and direct access will be denied.