Joris van Montfort

<p>Protect access to all your media files and implement your own custom file access rules using a hook. Works for apache with mod rewrite or nginx with some custom configuration. No Multisite support. This plugin is more or less a development tool for defining your own custom file access rules.</p>
<p>For nginx you will need to modify the config file as nginx does not handle .htacess files. Add the following code:</p>
<pre><code>location ~ "^/wp-content/uploads/(.*)$" {
    rewrite ^/wp-content/uploads(/.*\.\w+)$ /index.php?jvm_protected_media_file=$1;
}
</code></pre>
<h3>Hooks</h3>
<p>Without a custom hook all file access will be disabled. The user will see the 404 page for all requested files. Adding a hook is needed to handle your own file access rules. A simple example that could go into your functions.php:</p>
<pre><code>function my_file_access_rule($file_info) {
    // Implement your own logic here
    $userHasAccess = true;

    if($userHasAccess) {
        // Send the file output if users has access to the file
        JVM_Protected_Media::send_file_output($file_info['path']);
    }
}

add_action( 'jvm_protected_media_file', 'my_file_access_rule');
</code></pre>
<p>The jvm_protected_media_file action has one parameter with the following file information:</p>
<pre><code>Array
(
    [id] => id_of_the_file
    [url] => full/url/to/your/file
    [path] => full/path/to/your/file
    [is_resized_image] => bool (true if the requested file is a image thumbnail or resized version of an image)
)
</code></pre>
<h3>Actions</h3>
<p>Available actions:</p>
<ul>
<li>jvm_protected_media_loaded (fires as soon as the plugin is loaded)</li>
<li>jvm_protected_media_file (fires when a file is requested)</li>
</ul>
<h3>Functions</h3>
<p>To send the output of a file to you can call:</p>
<pre><code>JVM_Protected_Media::send_file_output($fullPathToFile)
</code></pre>


JVM Protected Media

Restrict access to all your media files and implement your own custom file access rules.

Drivingralle

Jan Reimers

<p>Only logged-in users can view the frontend, backend or content of the REST API if this plugin is activated. The password reset process on wp-login keeps on working.</p>
<ul>
<li>No options/settings</li>
<li>No by-pass</li>
</ul>
<h3>Compatibility</h3>
<ul>
<li>WooCommerce</li>
</ul>
<h3>Usage as MU-Plugin</h3>
<p>This plugin is very simple and can also be used as a must-use plugin. That way no admin of a website can deactivate the plugin, making sure the requirement of just authenticated  users is ensured.<br />
! No automatic updates are made for mu plugins</p>


Logged-in-only

It just works!

A Plugin to lock down the whole site to prevent public access.

JVM Protected Media vs Logged-in-only