Protect WordPress media files with token-based secure delivery, fine-grained access control, and SEO indexing protection.

Umang Prajapati

PTP Private Media gives you full control over who can access your WordPress media files. Stop search engines, bots, and unauthorised visitors from downloading your protected images, PDFs, videos, or documents.
Author: <a href="https://phptutorialpoints.in/" rel="nofollow ugc">Umang Prajapati</a> | <a href="https://profiles.wordpress.org/umangapps48/" rel="nofollow ugc">WordPress Profile</a> | <a href="https://github.com/umang48/secure-media-vault" rel="nofollow ugc">GitHub</a>
<h4>Core Features</h4>
🔐 Media Protection System 
* Prevent direct URL access to files in <code>/wp-content/uploads/</code> 
* Files are served through a secure PHP handler, not exposed directly 
* Automatic <code>.htaccess</code> rules block direct file access on Apache servers 
* Guidance provided for Nginx configurations
👥 Fine-Grained Access Control 
Set a protection level for every file in the Media Library:
<ul>
<li>Public – standard WordPress behaviour</li>
<li>Logged-in users only – any authenticated user</li>
<li>Specific roles – choose from all registered WordPress roles (Admin, Editor, Subscriber, etc.)</li>
<li>Password protected – custom password per file</li>
<li>Restrict to posts/pages – only accessible when referred from specific content</li>
</ul>
🔗 Secure File Delivery 
* Replace original media URLs with HMAC-signed, time-limited token URLs 
* Format: <code>example.com/ptp-restricted-media/{file-id}/{token}/</code> 
* Configurable token expiry (default: 1 hour) 
* Hotlink protection prevents embedding on external domains 
* Optional IP-address binding for tokens
🚫 SEO & Indexing Protection 
* <code>X-Robots-Tag: noindex, nofollow</code> header on all protected file requests 
* Optional <code>Disallow</code> entries in <code>robots.txt</code> for the uploads directory 
* Disable and redirect WordPress media attachment pages 
* wp_robots API integration for attachment pages
📂 Media Library Integration 
* Protection Settings panel on every attachment edit screen 
* Protection status column (<code>Protected / Public / Password / Role</code>) in list view 
* Bulk Actions: protect multiple files, change access rules, make public
⚡ Performance 
* Chunked streaming with HTTP Range support for large video/audio files 
* Configurable file-size threshold for streaming vs. single-pass delivery 
* Object cache support with cache invalidation on settings change 
* Scheduled cleanup of expired tokens and old access logs
🛡️ Security 
* HMAC-SHA256 signed tokens using WordPress secret keys 
* Nonce verification on all AJAX requests and form actions 
* All input sanitized and output escaped per WordPress standards 
* No direct file inclusion; <code>ABSPATH</code> check on every file 
* Clean uninstall via <code>uninstall.php</code>
<h4>Nginx Support</h4>
While <code>.htaccess</code> rules are written automatically for Apache, the plugin provides the correct Nginx configuration block in the admin dashboard for manual setup.
<h4>WooCommerce Compatibility</h4>
The access control system is designed to work alongside WooCommerce. Future versions will include native purchase-based access checks.

Alternatives to PTP Private Media

Top alternatives