Protected files

A gated article stops the text, but a PDF linked from it has its own address. Protected files close that gap: the file’s address checks the visitor’s access on every download, so a copied link is no use to anyone who isn’t entitled when they open it.

Protecting a file

Open the file in the media library and set Who can download:

Everyone: a normal public file.
Whoever can read the item it’s attached to: the item’s whole rule decides, exactly as on the page. A file that isn’t attached to an item grants nobody.
Members holding a level: for example Members holding Gold. Levels held through another count (Gold includes Silver).
Members with a feature: for example a downloads feature mapped to an add-on tag.

Anyone who can edit the file can always download it.

Choosing anything but Everyone moves the file, and every image size WordPress made of it, into wp-content/uploads/redeemid-protected/. From then on every address WordPress builds for it is https://example.com/?redeemid_file=<id>. Choosing Everyone again moves it back. The check reads the same synced account as the gates, so Shopify still decides who is entitled.

What a visitor gets

Entitled: the file. PDFs, images, audio, video and plain text open in the browser; everything else downloads. The response is private and never cached.
Signed out: a page asking them to sign in (HTTP 401), with a link to the item.
Signed in without access: a page saying their membership doesn’t include the file (HTTP 403), with a link to the item.

A direct link saved before the file was protected now points at a file that isn’t there. RedeemID redirects that 404 to the checked address, so old links keep working for members.

Close the folder on your web server

The check only holds if the web server refuses to serve the folder itself. Tools → Site Health tests this with a probe file and reports a critical issue if the folder is open.

Apache and LiteSpeed: nothing to do. RedeemID writes an .htaccess that denies every request. If Site Health still reports the folder open, the server ignores .htaccess files; deny the folder in the virtual host instead.
nginx: add this to the site’s server block, above any other location that matches uploads, and reload nginx. On a managed host, ask support to add it.

location ^~ /wp-content/uploads/redeemid-protected/ {
	internal;
}

For large files, the redeemid_file_sendfile filter hands the transfer to the web server (x-accel-redirect on nginx, x-sendfile on Apache or LiteSpeed) once RedeemID has checked access.

Limits

Byte ranges aren’t supported when PHP streams the file, so seeking far into a long video waits for the download. Use a server mode for media.
Old direct links redirect for the original file only, not for an image’s other sizes.
Plugins that move uploads to a CDN or object storage bypass this folder. Keep protected files on the server.
Uninstalling RedeemID leaves protected files where they are, still closed by the server rule. Set each one back to Everyone first if you want them public.
Each download and refusal is recorded on RedeemID → App events.

Documentation