ACF Secure File Field

A custom ACF field that provides a secure way to upload files, storing them outside the default WordPress Media Library with an enhanced UI and robust access control.

Description

The ACF Secure File Field plugin adds a new field type to Advanced Custom Fields, "Secure File". This field allows for file uploads that are stored in a protected directory on your server, separate from the standard wp-content/uploads folder. It features a modal-based interface for a smooth workflow, allowing you to either upload new files or select from previously uploaded secure files.

This is ideal for situations where you need to manage sensitive documents, client files, or any other asset that should not be publicly accessible through predictable URLs. The plugin generates a secure, unique download link for each file, with granular control over who can access it.

Key Features

• Secure Storage: Files are uploaded to a protected directory (default: wp-content/secure-uploads/) with an .htaccess file to prevent direct access.
• Intuitive Modal UI: A clean, modal-based interface to either upload a new file (with drag-and-drop support) or select from a library of existing secure files.
• Unique Download Links: Access files via a unique, non-guessable hash-based URL.
• Granular Global Access Control: Restrict file downloads to:
  • Anyone with the link.
  • Any logged-in WordPress user.
  • Users with specific roles.
• Per-File Access Control: Override the global rule for any single file. A Configure action in the Secured Files list opens a popup to keep the global settings or allow only specific roles to download that file.
• Download Access Column: The Secured Files list includes a Download Access column showing, per file, who is permitted to download it — the global default or the selected roles.
• Extra Upload Formats: Allows uploading formats the WordPress Media Library blocks by default (e.g. .jks), scoped to secure uploads only.
• Automatic Updates via GitHub: The plugin checks its public GitHub repository and offers updates directly on the WordPress Plugins screen.
• Independent of Media Library: Keeps your secure files completely separate from your public media assets.
• Custom Post Type Management: Uploaded files are managed as a secure-file custom post type, with a customized admin view for better management (direct downloads, synchronized file deletion).
• Customizable Upload Directory: Change the name of the secure storage folder from the settings page.
• Translation Ready: Ships with Ukrainian and Russian translations.

Installation

1. Install the Plugin:
   • Upload the acf-secure-file-field folder to the /wp-content/plugins/ directory.
   • Alternatively, install directly from the WordPress plugin repository.
2. Activate the Plugin: Activate the plugin through the 'Plugins' menu in WordPress.
3. ACF Requirement: Ensure you have Advanced Custom Fields (Free or Pro) version 5.0 or higher installed and activated.

How to Use

1. Add the Field:
   • In your ACF Field Group, click "Add Field".
   • Set the "Field Label" (e.g., "Secure Document").
   • Under "Field Type", select "Content" > "Secure File".
2. Using the Field:
   • Go to any post or page where your field group is active.
   • Click the "Select File" button. A modal window will appear.
   • To upload a new file: Stay on the "Upload New" tab. Drag and drop a file or click to use the file browser. The file will be uploaded and automatically selected.
   • To use an existing file: Click the "Select Existing" tab. A list of previously uploaded secure files will appear. Click the "Select" button next to the desired file.
3. Manage Files:
   • Once a file is selected, the field will display its name with "Download" and "Remove" buttons.
   • All uploaded files can be viewed in the WordPress admin under the "Secured Files" menu.
   • The list shows a Download Access column indicating who may download each file.
4. Configure Per-File Access:
   • In the Secured Files list, hover over a file and click Configure.
   • In the popup, Use global settings is enabled by default, so the file follows the global Access Control rule.
   • Uncheck it to activate the role checkboxes and grant download access to specific roles for that file only. Re-checking it disables the role options again and restores the global behavior.

Settings

To configure the plugin, navigate to Secured Files > Settings in your WordPress admin dashboard. A "Settings" link is also available on the main Plugins page for quick access.

• Global Download Access Control:
  • Who can download files?: Choose between "Anyone with the link," "Any logged-in user," or "Users with specific roles." This is the default rule applied to every file unless overridden per file.
• Per-File Download Access:
  • Set individually from the Configure action in the Secured Files list. A file is either set to follow the global settings or restricted to a chosen set of roles.
• General Settings:
  • Upload Directory Name: Set a custom name for the secure storage folder. Important: This setting can only be changed before any files have been uploaded. It becomes read-only to protect existing file paths.

Extra Upload Formats

By default WordPress only accepts file types from its Media Library allow-list. This plugin permits additional formats for secure uploads only (files are renamed and served through a PHP proxy, so this does not widen the site-wide Media Library). The .jks format is enabled out of the box. To allow more, add entries to the $asff_extra_mimes map (extension => MIME type) in the AJAX upload handler in acf-secure-file-field.php.

Automatic Updates

The plugin updates itself from its public GitHub repository (vitaliikaplia/acf-secure-file-field). It compares the installed version against the plugin header on the master branch and, when a newer version is available, shows the update on the WordPress Plugins screen just like any other plugin. The update branch can be overridden by defining the ASFF_GITHUB_BRANCH constant.

Template Usage Example

Here is a basic example of how to display the secure download link in your theme's template files.

<?php
// The field returns a File Array by default
$secure_file = get_field('your_field_name');

if ( $secure_file && is_array($secure_file) ) : ?>
    <h3>Download Our Secure Document</h3>
    <p>
        <a href="<?php echo esc_url( $secure_file['url'] ); ?>" class="button" download>
            Download <?php echo esc_html( $secure_file['name'] ); ?>
        </a>
    </p>
<?php endif; ?>

Frequently Asked Questions

Where are the files stored? By default, files are stored in /wp-content/secure-uploads/. This path is protected by an .htaccess file that prevents direct public access. You can change the directory name from the settings page before you upload any files.

Is this plugin compatible with ACF Pro? Yes, it is fully compatible with both the free and Pro versions of Advanced Custom Fields.

License

This plugin is licensed under the GPLv2 or later. See the LICENSE URI for more information. This makes it fully compatible with the WordPress license.