Zodan Authorized Downloads

This plugin allows site admins to protect specific attachment file types (e.g. Pdf, Doc(x)) from direct access. Instead, the files are served through WordPress, allowing you to check if a user is logged in or has the required permissions before granting access.

Features: * Adds a checkbox to media attachments to mark them as “Authorized only”. * Creates an internal page and rewrite rules to intercept requests to protected file types. * Checks user login status (or other custom logic you add) before serving files. * Provides a settings page to specify which file types should be protected.

License

This plugin is licensed under GPLv2 or later.

1. 01Upload the plugin files to /wp-content/plugins/z-authorized-downloads/ or install via the Plugins screen.
2. 02Activate the plugin through the ‘Plugins’ screen.
3. 03Go to Settings → Authorized Downloads to set which file types should be protected and which roles can download protected files
4. 04Mark attachments as “Authorized only” in the Media Library to restrict access.
5. 05Optionally, override the default permitted roles per attachment in the Media Library.

Can I customize the authorization logic?

Yes. The plugin checks if the user is logged in by default, but you can extend handle_protected_request() to add role checks or other conditions.

What happens to unprotected files?

Files that are not marked as “Authorized only” will still be directly accessible by URL.

Do I need to manually edit .htaccess?

No. The plugin will manage the .htaccess rules for you when you save settings.

Do you have plans to improve the plugin?

We currently have on our roadmap: * Make the plugin pluggable – adding hooks for certain checks. * Adding a custom capability to manage which users can edit settings (both general and per file). * Adding more translations.