Secure Mode: protect a document

Every file in the Media Library has a public URL. Anyone who finds /wp-content/uploads/2026/10/report.pdf can download it, whatever the page around it says. Secure Mode closes that door.

Protect a file#

1. Open Media → Library and click the PDF or EPUB.
2. In the attachment details find Foliora Secure Mode and tick Protect this file. In the media popup it saves at once; on the full edit screen click Update.
3. The status reads “Protected: the public file URL no longer works; Foliora viewers load it through signed links.”

Every page that already embeds the file keeps working — including older posts that still use the old URL.

What happens behind the scenes#

• The file moves to a protected folder with an unguessable name inside uploads.
• Viewers receive a signed link instead of the file URL:

  /foliora-doc/{id}/{context}/{expires}/{signature}/{filename}

  The context binds it to the logged-in user (or a protected link), and it expires.
• The stream supports HTTP Range requests, so large files load page by page.
• Pages with a protected viewer send DONOTCACHEPAGE, so cache plugins never store a personal link.
• For editors, wp_get_attachment_url() returns a signed URL; everyone else gets a reference URL that never serves the file.

Settings#

Foliora → Pro Settings → Protection:

Setting	Default	Meaning
Protected files	Off	“Only logged-in users can open protected files” — visitors see a log-in prompt. Protected links still work for their recipients.
Signed link lifetime	12 hours	1–72 hours. A reader who keeps the page open longer only needs to reload it.
Apply locks and watermark to	Protected files only	Or every Foliora viewer on the site. See Locks & watermark.

Make sure the folder is blocked#

Pro Settings checks whether the protected folder is really unreachable and shows the result.

• Apache / LiteSpeed: Foliora writes an .htaccess into the folder. It works when the host allows .htaccess files (AllowOverride).
• nginx: add the rule shown in Pro Settings inside your server block, above other location ~* rules, and reload nginx. It looks like:

  location ~* ^/wp-content/uploads/foliora-protected-abc123…/.*\.(pdf|epub)$ { deny all; }

  Copy the exact rule from Pro Settings — the folder name is random for every site. On managed hosting, send the rule to support, then click Check again.

Unprotect a file#

Untick Protect this file; the file moves back to its original folder. If another file now sits at that path, the file stays protected and you are told why.

Developers: the actions foliora_pro/protected and foliora_pro/unprotected fire with the attachment ID.