Pippin Williamson

Easy Digital Downloads

<p>This is a simple extension for Easy Digital Downloads to restrict file download access to the IP address originally used to purchase the files.</p>
<p>The primary purpose of this extension is to prevent users from sharing file download links.</p>


Easy Digital Downloads – Lock Downloads to IP

Lock file download access to the original purchase IP for Easy Digital Downloads

cosmaut

<p>CosmautDL is a multi-cloud download manager plugin for WordPress.<br />
It turns scattered cloud-drive links into a clean “download card” experience, and provides dedicated download pages, a site-wide file-tree index, and click statistics for site owners.</p>
<p>Key features:</p>
<ul>
<li>Unified download card UI for posts/pages</li>
<li>Dedicated download page route per post</li>
<li>Redirect route to keep outbound links tidy</li>
<li>File-tree page to browse all shared resources</li>
<li>Click statistics stored in your own database</li>
<li>Optional WeChat QR unlock workflow</li>
<li>Assets loaded only when needed</li>
</ul>
<h3>Supported providers</h3>
<p>Baidu Pan, 123Pan, Aliyun Drive, Tianyi Cloud, Quark, PikPak, Lanzou, Xunlei, Weiyun, OneDrive, Google Drive, Dropbox, MEGA, MediaFire, Box, and Other.</p>
<p>Routes (pretty permalinks recommended):</p>
<ul>
<li>Download page: /downloads/{post_id}.html (or ?cosmdl_download=1&post_id={id})</li>
<li>File tree: /downloads/tree.html (or ?cosmdl_tree=1)</li>
<li>Stats entry: /downloads/stats.html (or ?cosmdl_stats=1; admin-only)</li>
<li>Redirect: /{prefix}/{post_id}/{type}.html (or ?cosmdl_redirect=1&post_id={id}&type={type})</li>
</ul>
<p>Data and privacy overview:</p>
<ul>
<li>Stores download click logs in a custom table: {wp_prefix}cosmdl_clicks (post_id, type, attach_id, user_id, ip, ua, referer, success, created_at).</li>
<li>Core features do not require external services.</li>
</ul>
<h3>Privacy/External Services</h3>
<ul>
<li>Data Collection: The plugin records the IP, UA, Referer, and time of download clicks only for backend statistics and troubleshooting; data is stored in your database and never sent outside.</li>
<li>External Services (Optional): When “IP Geolocation Display” is enabled, the admin backend queries ipapi/ip-api/ipinfo for geolocation; results are cached and displayed in wp-admin. No external requests occur when disabled.</li>
<li>WeChat QR Unlock (Optional): Redirects the visitor browser to WeChat authorization (open.weixin.qq.com) and the server calls api.weixin.qq.com endpoints to exchange code for openid and check subscription. The plugin does not persist openid; it uses a short-lived unlock flag (~10 minutes) and caches the official account access_token (up to ~2 hours).</li>
<li>User Control: You can disable these optional features at any time in plugin settings; uninstalling the plugin cleans up plugin-created data and caches.</li>
<li>Compliance Note: In some jurisdictions, IP addresses are personal data; obtain consent or meet legal requirements before enabling IP geolocation.</li>
</ul>
<h3>External services</h3>
<p>This plugin can connect to external services only when you enable related options.</p>
<h3>1) WeChat OAuth and subscription check</h3>
<ul>
<li>Service: WeChat / Tencent</li>
<li>Purpose: Used for WeChat unlock mode authentication</li>
<li>Endpoints:
<ul>
<li>https://open.weixin.qq.com/connect/oauth2/authorize (OAuth authorize, visitor browser redirect)</li>
<li>https://api.weixin.qq.com/sns/oauth2/access_token (exchange OAuth code for openid)</li>
<li>https://api.weixin.qq.com/cgi-bin/token (fetch official account access_token)</li>
<li>https://api.weixin.qq.com/cgi-bin/user/info (check subscription status)</li>
</ul>
</li>
<li>When: Only if you enable WeChat unlock in CosmautDL settings and visitors open the unlock URL in WeChat after scanning the QR code.</li>
<li>Data sent:
<ul>
<li>Visitor browser to open.weixin.qq.com: appid, redirect_uri, response_type, scope, state, and standard HTTP request metadata handled by WeChat (for example IP address and user agent).</li>
<li>Your server to api.weixin.qq.com: appid, appsecret, OAuth code, grant_type; later access_token, openid, lang.</li>
</ul>
</li>
<li>Data stored (local): Does not store openid permanently; stores a short-lived unlock flag transient (10 minutes) and caches the official account access_token transient (up to ~2 hours, based on API expires_in).</li>
<li>User control: You can disable this feature at any time in plugin settings.</li>
<li>Data deletion: Transients expire automatically.</li>
<li>Terms of Service: https://www.wechat.com/en/service_terms.html</li>
<li>Privacy Policy: https://www.wechat.com/en/privacy_policy.html</li>
</ul>
<h3>2) IP geolocation lookup</h3>
<ul>
<li>Services (selectable in settings):
<ul>
<li>https://ipapi.co/</li>
<li>https://ip-api.com/</li>
<li>https://ipinfo.io/</li>
</ul>
</li>
<li>Purpose: To display IP location in admin download statistics</li>
<li>When: Only if you enable Show IP location in stats and open stats details in wp-admin.</li>
<li>Data sent: IP address from your click logs, from your server to the chosen provider (requests are cached).</li>
<li>Caching: Results are cached for 168 hours (7 days) by default to reduce API calls.</li>
<li>User control: You can disable this feature at any time in plugin settings.</li>
<li>Data Flow: Your server to IP Geolocation API and back to your server (IP addresses are sent for location lookup)</li>
<li>Privacy Impact: IP addresses are considered personal data in some jurisdictions; cached results help minimize exposure</li>
<li>Data Deletion: Cached geolocation data automatically expires after 7 days; IP addresses in click logs can be deleted from admin stats page</li>
<li>Terms of Service:
<ul>
<li>ipapi: https://ipapi.co/terms/</li>
<li>ip-api: https://ip-api.com/docs/legal</li>
<li>ipinfo: https://ipinfo.io/terms-of-service</li>
</ul>
</li>
<li>Privacy Policies:
<ul>
<li>ipapi: https://ipapi.co/privacy/</li>
<li>ip-api: https://ip-api.com/docs/legal</li>
<li>ipinfo: https://ipinfo.io/privacy-policy</li>
</ul>
</li>
</ul>
<h3>Third-party libraries</h3>
<h3>phpqrcode</h3>
<ul>
<li>Library: phpqrcode (LGPL-3.0)</li>
<li>Purpose: On-site QR code generation for WeChat unlock functionality</li>
<li>License: GNU Lesser General Public License v3.0</li>
<li>License URI: https://www.gnu.org/licenses/lgpl-3.0.html</li>
<li>Usage: Used for generating unlock QR codes without external dependencies</li>
<li>Compatibility: LGPL-3.0 is compatible with GPLv3</li>
</ul>


CosmautDL

Multi-cloud download manager: unified download cards, dedicated download pages, a file-tree index, and click statistics.

Easy Digital Downloads – Lock Downloads to IP vs CosmautDL