Folio Gatehouse lets you protect files inside your uploads directory by restricting access to specific WordPress user roles. Files are served through PHP — the web server never delivers them directly — so direct URL access is blocked regardless of link sharing. Key features: Zone-based protection —
PricingFree downloadThe WordPress.org download is free. Pro versions, add-ons or external services may cost extra.
CompatibilityRequires WordPress 5.8 and PHP 7.4.
SourceWordPress plugins · Oct 30, 2026
01 / Source details
Aboutthistool.
Folio Gatehouse lets you protect files inside your uploads directory by restricting access to specific WordPress user roles. Files are served through PHP — the web server never delivers them directly — so direct URL access is blocked regardless of link sharing.
Key features:
Zone-based protection — define named zones (subfolders inside your uploads directory) and assign allowed roles to each
Custom denial screens — create HTML pages shown to blocked users, with full control over styling and messaging; separate screens for anonymous and logged-in users
Redirect on denial — optionally redirect denied users to any URL (e.g. a sales page or membership signup) instead of showing a denial screen
Login redirect shortcode — [rbfa_login_link] inserts a secure login link that returns the user to the originally-requested file after authentication, using an opaque token so no file path is exposed in the URL
Zone virtual pages — each zone automatically gets a front-end page at /protected-zone/{slug}/ with customisable title and body content, rendered inside your active theme
Browsable file listing — [rbfa_files] shortcode renders a collapsible, downloadable file listing for authorised users, with per-directory file counts, sizes, and ZIP download buttons
Access logging — every request is logged with timestamp, username, IP, file path, and status; filterable, sortable, and exportable as CSV
Role management — create and manage custom WordPress roles ( fgh_ prefix) directly from the plugin, with searchable member management
.htaccess integrity — automatically writes and repairs rewrite rules across all protected directories; optional hourly cron
NGINX support — dedicated tab generates ready-to-copy location blocks when NGINX is detected
Export / Import — back up and transfer zones, roles, denial screens, and settings as a JSON file; conflict resolution on import
Files served through PHP ( readfile ) — web server never delivers protected files directly
Path traversal blocked by realpath() boundary check before any file is served
Login redirect tokens are opaque — no file path, role, or zone information in the URL
Denial screen HTML filtered through a strict wp_kses allowlist on save and read-back
CSRF protection on every form via WordPress nonces
All ORDER BY clauses use a server-side whitelist to prevent SQL injection
Requirements
Apache with mod_rewrite enabled, or NGINX (with manual server block configuration — see the NGINX Config tab)
See it in action
Screenshots & previews.
Zones tab — manage protected directories and assign rolesLogs tab — filterable, sortable access log with stats widgetRoles tab — create and manage custom roles with member managementDenial Screens tab — manage HTML denial pages and login redirect URLsSettings tab — system settings, export/import, and data managementFront-end zone page — [rbfa_files] collapsible file listing with per-directory download buttons
02 / Source details
Gettingstarted.
01Upload the folio-gatehouse folder to wp-content/plugins/
02Activate the plugin from Plugins → Installed Plugins
03Navigate to Folio Gatehouse in the sidebar
04Go to Settings and set your base directory (the folder inside wp-content/uploads/ that will contain all protected zones)
05Go to Zones and add zone rows — assign a folder slug and the roles that may access it
06Click Save & Sync Zones
If you are running NGINX, visit the NGINX Config tab for the server block rules you need to add before protection takes effect.
03 / Source details
Frequently asked questions.
Does this work with NGINX?
Yes, but you need to add server block rules manually. The plugin detects NGINX and shows a dedicated tab with ready-to-copy location blocks.
Will my files be accessible via direct URL?
Not after .htaccess rules are in place (Apache) or after you add the NGINX location blocks. All matched requests are routed through WordPress and through the plugin’s access check before any file content is returned.
What happens to my data if I deactivate or delete the plugin?
Deactivation never deletes any data. Deletion only removes data if you explicitly enable that option in Settings → Data Management .
Can I show different denial messages to guests vs logged-in users?
Yes. Each zone has separate denial screen dropdowns for anonymous visitors and logged-in users who lack the required role.
Can I use this to protect files for a WooCommerce membership?
Yes. Create a custom role for your members (or use an existing WooCommerce role), assign it to a zone, and the plugin will enforce access on every file request.
Does the login redirect shortcode work with custom login pages?
Yes. Configure the login page URL per denial screen (supports absolute URLs and relative paths like /my-account ).
Website LLMs.txt and LLMs-Full.txt Generator is an LLMs.txt generator and llms-full.txt generator for WordPress. It helps site owners generate, manage, preview, validate, and serve AI discovery files from published public content. Use it to create structured /llms.txt and optional /llms-full.txt end
EngageDock AI is a customizable floating contact widget for WordPress websites that want more leads and faster visitor communication. It helps small businesses turn website traffic into calls, texts, emails, and callback requests from one clean contact panel. Key Features: Click-to-Call – One tap ca
Altify AI is an auto ALT text and AI ALT text plugin for WordPress images. It helps generate descriptive image ALT text for accessibility and image SEO. Use bulk image ALT text tools for your Media Library, generate featured image ALT text automatically, and scale WooCommerce image ALT updates with
The Accepted Payment Methods plugin is a straightforward, lightweight solution that enhances your website by displaying visually appealing icons of the payment methods you accept. This plugin is ideal for a variety of websites, including e-commerce platforms, service-oriented websites, and informati