Covered in this article:
MemberPress has some powerful features to help you protect static files. MemberPress's file protection works at the web-server level which provides absolute protection of each file. For example, even if a person without access to a file somehow managed to get a direct link to it, MemberPress would stop them in their tracks, and ask them to register or log in (if they've already registered) before being allowed to download that file.
What types of files can MemberPress Protect?
MemberPress can protect any file that is not required for the proper functioning of your website.
Therefore MemberPress can
only protect the following file types:
'zip','gz','tar','rar','doc','docx','xls','xlsx','xlsm','pdf','mp4','m4v','mp3','ts','key','m3u8'
If you want to protect any file type that is not listed above, we recommend just zipping them up and protecting a single .zip file instead.
Additionally, you can add some custom code to your theme's functions.php file if you have one, or to a plugin the
WPCode plugin (please check this article for details: How to add custom code snippets in WPCode). Here is an example of that code:
function add_types_protectable($types, $rules) {
$types[] = 'csv';
return $types;
}
add_filter('mepr_rewrite_rules_protect_types', 'add_types_protectable', 11, 2);
After adding that custom code you will need to refresh your WordPress permalinks by going to your WordPress Dashboard > Settings > Permalinks > and simply clicking the ‘Save Changes' button at the bottom of that page.
Protecting a Single File
If you have one file to protect then here's how you'd do it:
- Upload the file using the WordPress Media Uploader.
- Create a Custom URI Rule to protect the file.
Say the file you uploaded had this URL:
http://example.com/wp-content/uploads/2015/10/report.pdf
The Rule you'd create for this file would be a Custom URI type pointing at just the path (part after
http://example.com) to the file. Thus, in the text box for this Rule, you would type in the followin:
/wp-content/uploads/2014/12/report.pdf
Though this is a relatively simple process for a small number of files, it can become time-consuming if applied to a larger number of files. So let's see how you can create 1 Rule to protect multiple files.
Multiple Files
Now let's say you have 10 files and want the same membership level to have access to each.
The idea here is that you'd want to either put each file in a special folder with FTP (recommended), or make sure that each file you upload via the Media Uploader has a common prefix (not recommended unless FTP isn't an option).
Even though we don't recommend protecting multiple files uploaded using the WordPress Media Uploader, we do understand that there may be times you want/need to. Therefore, if you upload these files via the Media Uploader they'd have the following URLs:
http://example.com/wp-content/uploads/2015/10/bronze_report.pdf http://example.com/wp-content/uploads/2015/10/bronze_report.doc http://example.com/wp-content/uploads/2015/10/bronze_report.docx http://example.com/wp-content/uploads/2015/10/bronze_analysis.pdf http://example.com/wp-content/uploads/2015/10/bronze_analysis.doc http://example.com/wp-content/uploads/2015/10/bronze_analysis.docx http://example.com/wp-content/uploads/2015/10/bronze_groupings.pdf http://example.com/wp-content/uploads/2015/10/bronze_groupings.doc http://example.com/wp-content/uploads/2015/10/bronze_groupings.docx http://example.com/wp-content/uploads/2015/10/bronze_archive.zip
Now all you'd have to do is create 1 Custom URI type Rule with this as its path:
/wp-content/uploads/2015/10/bronze_
This will protect any file in the /wp-content/uploads/2015/10/ folder that has a name beginning with “bronze_”.
Multiple Files with FTP
FTP/SFTP is a robust way to transfer files from your local computer to your website. Most web hosts provide free FTP services so you can access your site files remotely from your own computer. Availability of FTP can vary from web host to web host and can have different requirements.
Typically you'll need an FTP client like FileZilla or Cyberduck to connect to your server via FTP/SFTP. This will allow you to have filesystem access to your webserver to create folders and upload files in a way similar to how you'd copy files between folders on your own local computer.
In this example we'll use FTP to create a folder named protected and import our files into it so we have the following URLs now:
http://example.com/protected/report.pdf http://example.com/protected/report.doc http://example.com/protected/report.docx http://example.com/protected/analysis.pdf http://example.com/protected/analysis.doc http://example.com/protected/analysis.docx http://example.com/protected/groupings.pdf http://example.com/protected/groupings.doc http://example.com/protected/groupings.docx http://example.com/protected/archive.zip
This scenario can be superior to using the WordPress Media Uploader if you're planning on adding files to your folder later because WordPress's Media Uploader will sometimes put files uploaded at different times in different folders.
So with this example, all you'd have to do is create a Custom URI type Rule with this as the path (typed into the text box for the Rule):
/protected/
Now let's look at using some more advanced matching with Regular Expressions.
Regular Expressions
Regular Expressions is a unique and descriptive search syntax commonly used across all modern programming languages to select and process text. It will allow you to protect very specific groups of files with ease.
The idea here is that it will allow you to match patterns in a given URL and protect the URL if it matches one of your Custom URI type Rules with regular expression enabled.
For example, in the FTP example from above, if you wanted to allow some users to have access to just the pdf's and others to have access to your pdf, doc, docx, and zip files you could create 2 different regular expression Rules — the first for one membership level and the second for another.
The first Rule for your first membership level would have a path of something like:
^/protected/.*\.pdf
The second Rule for your other membership level would have a path of something like:
^/protected/.*\.(pdf|doc|docx|zip)
Granted, Regular Expressions can be difficult to master, but they can provide some powerful matching and file-protecting capabilities in MemberPress Custom URI type Rules. We've found that
http://www.regular-expressions.info/ is a good resource for anyone wanting to figure out this powerful technology. Also, if you do have some more complex needs, our support team is quite masterful in figuring out Regular Expressions for whatever you need to protect — so feel free to submit a support request if you need help with this feature.
MemberPress URI Rules Explained
What you'll see in the video: a more in-depth explanation of MemberPress Custom URI Rules.
Technical Requirements
Because this feature utilizes your website's underlying webserver to protect files, there are some technical requirements that must be met in order for this feature to work properly. We've written MemberPress to work with the most common server configurations out there but if things aren't working fully for you, here are some things to check:
- Your website must be served by Apache or an Apache-compatible web server like Litespeed. The rewrite rules that MemberPress installs are specific to Apache. If you're unsure what web server you're using then it's probably Apache, but to be sure, you can contact your web host. MemberPress does not support file protection on other web servers like Nginx, IIS, or other non-Apache-based servers. However, if your webserver is using Nginx as a proxy (in front of Apache), you may be able to use the Nginx proxy bypass code outlined in the Nginx section on this page.
- Your WordPress install should have sufficient privileges to make changes to your .htaccess file. If your .htaccess file is unwritable by WordPress then you can edit it manually by following our advanced rewrite instructions.
- Your WordPress install must have the ability to write files in your /wp-content/uploads folder. This is also a requirement for the WordPress Media Uploader to upload files so if that's working then this should be working as well.
- Cloudflare and other CDN's and caching have the potential of getting in the way of file protection. This is because they either cache the file so it can not be protected, or they interfere with our protection cookies and cause infinite redirect loops.
- MemberPress Rewrite Rules must be enabled. Go to MemberPress->Settings->General, uncheck the “Disable Rewrite Rules” checkbox, and save the changes.
We've also seen users with custom rewrite rules that have interfered with the MemberPress rewrite rules. So if this feature doesn't seem to be working and you feel like you've gone through all of these steps, please contact our support team and we'll help.
Protect Additional File Types
MemberPress can protect additional file types. Keep in mind that each protect-able file-type HTTP request will cause a second request to the site to check if the file is protected or not. For this reason, we do not recommend protecting files like images (jpg, png, gif, etc), scripts (css, js), or font files as it could cause a significant load to your server.
Use the following custom code in a plugin like the WPCode to add additional file types. Please check this article for details: How to add custom code snippets in WPCode.
The code below adds “html” and “htm” file types to the list of protected files. Once adding this code, you'll also need to refresh your WordPress permalink settings to force WordPress to update the .htaccess file for your site.
function add_types_protectable($types, $rules) {
$types[] = 'htm';
$types[] = 'html';
return $types;
}
add_filter('mepr_rewrite_rules_protect_types', 'add_types_protectable', 11, 2);
