isaacchapman

The Htaccess Secure Files plugin can only be activated on Apache web servers with mod_rewrite enabled, and will automatically raise an error upon activation if this is not the case.
The Htaccess Secure Files plugin allows for setting files to be accessible only to visitors who have a specified IP address or <a title="WordPress role or capbility" href="https://codex.wordpress.org/Roles_and_Capabilities" rel="nofollow ugc">WordPress role or capability</a>. By using <a title=".htaccess files" href="http://en.wikipedia.org/wiki/Htaccess" rel="nofollow ugc">.htaccess files</a> to secure the content instead of a separate directory outside the web root, WordPress’s native media library functionality can be used to upload secure files and link to them from within the visual editor.
By default all built-in WordPress roles will be allowed to access content that is marked as secure. The Settings -> Secure Files admin screen controls which roles, capabilities, and IP addresses are allowed to view or download secured files. If a custom role or capability is desired, there are several <a title="WordPress plugins" href="https://wordpress.org/extend/plugins/search.php?q=roles+capabilities" rel="ugc">WordPress plugins</a> capable of creating and editing roles and capabilities.
Any visitor that matches any selected role, capability, or IP address will be allowed to access secured files.
This plugin works by creating a .htaccess files in the directory of each secured file. If you manually edit the .htaccess file and it becomes corrupt (a 500 Internal Server Error is the most likely symptom), I recommend deleting the .htaccess file and then edit and save each secured item in the media library.

Htaccess Secure Files

Allows securing files in WP's media library to be only accessible to users with specific roles, capabilities, or IP addresses.

citywanderer

Miina Sikk

Using the password protection will give you extra security layer of protection from brute force hacking attacks. Additionally, it’s also an easy way to password protect your entire site, without needing to create separate WordPress users for each visitor.
When you enable the password protection, the user won’t be able to see anything – not even see the protected page – until he/she inserts the username/password. You can password protect the whole website, including the administrator pages; you can password protect the administrator pages; or you can password protect the WordPress login page.
Free plugin options include:
<ul>
<li>Enabling/disabling the password protection to wp-login.php, WordPress admin pages. Note that you’ll be asked to re-type the .htaccess username/password you created before enabling any of the settings – to ensure that you wouldn’t enable the password protection without even knowing the password yourself!</li>
<li>Modifying the existing users: you can change any .htaccess user’s password and remove the users.</li>
<li>Adding one .htaccess user. </li>
</ul>
Premium plugin options:
<ul>
<li>Create/modify an unlimited number of .htaccess users;</li>
<li>Protect your whole site, making it accessible to only those who have the .htaccess user.</li>
</ul>
If you have any other suggestions, please let us know! You can contact us via http://www.wpsos.io/wordpress-plugin-htaccess-site-access-control/
For more information and support, check out: http://www.wpsos.io/wordpress-plugin-htaccess-site-access-control/

.htaccess Site Access Control

Using the password protection will give you extra security layer of protection from brute force hacking attacks. Additionally, it's also an easy  …

Htaccess Secure Files vs .htaccess Site Access Control