Joris van Montfort

<p>Protect access to all your media files and implement your own custom file access rules using a hook. Works for apache with mod rewrite or nginx with some custom configuration. No Multisite support. This plugin is more or less a development tool for defining your own custom file access rules.</p>
<p>For nginx you will need to modify the config file as nginx does not handle .htacess files. Add the following code:</p>
<pre><code>location ~ "^/wp-content/uploads/(.*)$" {
    rewrite ^/wp-content/uploads(/.*\.\w+)$ /index.php?jvm_protected_media_file=$1;
}
</code></pre>
<h3>Hooks</h3>
<p>Without a custom hook all file access will be disabled. The user will see the 404 page for all requested files. Adding a hook is needed to handle your own file access rules. A simple example that could go into your functions.php:</p>
<pre><code>function my_file_access_rule($file_info) {
    // Implement your own logic here
    $userHasAccess = true;

    if($userHasAccess) {
        // Send the file output if users has access to the file
        JVM_Protected_Media::send_file_output($file_info['path']);
    }
}

add_action( 'jvm_protected_media_file', 'my_file_access_rule');
</code></pre>
<p>The jvm_protected_media_file action has one parameter with the following file information:</p>
<pre><code>Array
(
    [id] => id_of_the_file
    [url] => full/url/to/your/file
    [path] => full/path/to/your/file
    [is_resized_image] => bool (true if the requested file is a image thumbnail or resized version of an image)
)
</code></pre>
<h3>Actions</h3>
<p>Available actions:</p>
<ul>
<li>jvm_protected_media_loaded (fires as soon as the plugin is loaded)</li>
<li>jvm_protected_media_file (fires when a file is requested)</li>
</ul>
<h3>Functions</h3>
<p>To send the output of a file to you can call:</p>
<pre><code>JVM_Protected_Media::send_file_output($fullPathToFile)
</code></pre>


JVM Protected Media

Restrict access to all your media files and implement your own custom file access rules.

zoltanlaczko

<p>Using the password protection will give you extra security layer of protection from brute force hacking attacks. Additionally, it’s also an easy way to password protect your entire site, without needing to create separate WordPress users for each visitor.</p>
<p>When you enable the password protection, the user won’t be able to see anything – not even see the protected page – until he/she inserts the username/password. You can password protect the whole website, including the administrator pages; you can password protect the administrator pages; or you can password protect the WordPress login page.</p>
<p>The plugin options include:</p>
<ul>
<li>Enabling/disabling the password protection to wp-login.php, WordPress admin pages.</li>
<li>Modifying the existing users: you can change any .htaccess user’s password and remove the users.</li>
<li>Create/modify an unlimited number of .htaccess users;</li>
<li>Protect your whole site, making it accessible to only those who have the .htaccess user.</li>
</ul>
<p>This plugin is originally was based on <a href="https://wordpress.org/plugins/htaccess-site-access-control/" rel="ugc">.htaccess Site Access Control</a>. That plugin was working fine but it was abandoned for years and not compatible with the latest WordPress. Most part of the plugin were refactored and translated.</p>


htaccess protect

htaccess protect - Protect your wordpress login or admin pages with password.

JVM Protected Media vs htaccess protect