Staff policies, member resources, client files: plenty of documents on WordPress sites are meant for logged-in users only. The usual first attempt is to put the download link on a members-only page. Unfortunately, that doesn’t protect the file.
Why hiding the link isn’t enough
Files in the Media Library live in /wp-content/uploads/, and your web server sends them directly to anyone who requests their address. WordPress doesn’t run for that request, so no login check ever happens.
That means anyone with the address can download the file: someone who was forwarded the link, someone who copied it before their account was removed, or a search engine that found it. Media Library addresses are also predictable, because they follow the year and month the file was uploaded.
What proper protection needs
To really restrict a document, three things need to be true:
- The file is served through WordPress, by code that checks who the visitor is before sending it.
- The file’s direct address is blocked, so the check can’t be skipped.
- Restricted documents don’t leak into document lists, search results, or block output for people who can’t open them.
Membership and file protection plugins can handle the first two for the whole Media Library, and are a good fit if you sell downloads or protect lots of media. If what you need is a library of documents with different access levels, a document manager does all three.
Restricting documents with DocVault
DocVault serves every document through its own download link, which checks access before sending the file. Here’s how to set it up.
1. Choose a default
In Documents → Settings, set Default Document Access to Public or Logged-in users only. New documents use this setting.
2. Override it per document
Each document has an Access Control box. Leave it on the global default, or set that document to Public or Logged-in users only. So you can keep most documents public and lock down a few, or the other way round.
Need finer control? DocVault Pro adds a Specific roles option, so you can restrict a document to, for example, Editors or Subscribers only.
3. Check what visitors see
Open your document list in a private browser window. Documents for logged-in users only are left out of the list for logged-out visitors. If someone follows a direct download link without permission, they get a “You do not have permission to access this document” message instead of the file.
The DocVault block and inline document links show nothing for restricted documents, so even the title stays hidden.
Administrators and the document’s author can always open it.
4. Make sure the files themselves are protected
DocVault stores files in /wp-content/uploads/trdv-documents/ and blocks direct web access to that folder. On Apache servers this happens automatically. Nginx ignores those rules, so it needs one line of server configuration.
To check, go to Tools → Site Health. DocVault tests whether a stored file can be downloaded directly, and if it can, shows you the exact rule to add. The troubleshooting guide has the details.
A few extras worth knowing
- Expiry dates: set a date on any document and its download link stops working after that date, so out-of-date documents can’t be opened by accident.
- Site search: if you include documents in WordPress search results, documents restricted to logged-in users are hidden from logged-out visitors.
- Who can upload: Minimum Role for Uploads in the settings controls who can add and manage documents.
- Download tracking: every download is counted, and Pro shows who downloaded which version and when.
Quick checklist
- Documents are served through a link that checks access, not straight from
/wp-content/uploads/. - Opening a stored file’s direct address in a private window is refused.
- Restricted documents don’t appear in lists or search results for logged-out visitors.
- Old or replaced documents are expired or removed, not left online.