Require login for the WordPress Media Folder

While this solution is designed to work across all systems, there may be specific circumstances where it does not function as expected on your setup.
Some clients have reported issues when downloading large files > 1GB.

Usage When you enable this option, the plugin will attempt to block direct access to your WordPress site’s Media Library and the /wp-content/uploads folder. It will attempt to redirect any request for a file in /wp-content/uploads to WPO365’s secure download script. The script first checks whether it has already verified user access by looking for a cookie named "wordpress_wpo365_mlda". If the cookie is missing, it then checks if the user is logged in. If the user is not logged in, WPO365 will redirect them to Microsoft for authentication or deny access. Otherwise, the requested file will be served. Enabling this option will modify your website’s .htaccess file by adding rewrite rules. These rules will redirect requests to a proxy, which determines the location of the secure download script based on the premium plugin you have installed.

IMPORTANT When you enable this option on a WordPress installation that runs on an Apache web server, then the plugin will attempt to automatically add rewrite rules to your site's so-called ".htaccess" file. If your site uses another web server - for example NGINX or IIS or Azure App Service, then please scroll down for instructions below to update the rewrite rules manually.

Secure Download Mode

The Secure Download Mode setting allows the plugin to hand off file delivery to the web server after access has been authenticated and authorized. Depending on your server environment, this can improve download performance and provide more reliable handling of large files.

The following modes are available:

PHP This is the default mode. Files are served directly by PHP after the plugin has verified that the user is authorized to access the requested file.
Use X-Sendfile (Apache) When enabled, the plugin instructs the Apache web server to serve the file using the X-Sendfile response header. This can significantly reduce PHP memory usage and improve the handling of large downloads.
Use X-LiteSpeed-Location (LiteSpeed) When enabled, the plugin instructs the LiteSpeed web server to serve the file using the X-LiteSpeed-Location response header. This can improve performance and allows the web server to handle file delivery directly.

IMPORTANT Only enable a hand-off mode if your server is configured to support the corresponding response header. For example, when using X-Sendfile with Apache, the mod_xsendfile module must be installed and enabled. If the required server support is not available, file downloads may fail. A good indication that the header is not supported by your server is when you see the X-Sendfile as part of the raw response.

NOTE Changes to the Secure Download Mode setting may not take effect immediately. The selected mode is cached in the wordpress_wpo365_mlda cookie to avoid loading WordPress for every download request. After changing this setting, you may need to delete the wordpress_wpo365_mlda cookie or wait for it to expire before the new mode is applied.

Instructions for Apache (.htaccess)

Please try and operate the toggle as illustrated below first.

If an error is returned, then please try and update your site's .htaccess manually instead, by adding the lines below to the end of the file.

<IfModule mod_rewrite.c>
RewriteCond %{REQUEST_URI} ^/wp-content/uploads/
RewriteRule ^wp-content/uploads/(.*)$ /wp-content/plugins/wpo365-login/Services/Secure_Download_Proxy.php?file=$1 [L]
</IfModule>

Instructions for NGINX

In your server block, add the following config.

location ~* ^/wp-content/uploads/(.)$ {
    rewrite ^/wp-content/uploads/(.)$ /wp-content/plugins/wpo365-login/Services/Secure_Download_Proxy.php?file=$1 last;
}

Instructions for IIS / Azure App Service

<rewrite>
  <rules>
    <rule name="Secure Uploads" stopProcessing="true">
      <match url="^wp-content/uploads/(.*)$" />
      <action type="Rewrite" url="/wp-content/plugins/wpo365-login/Services/Secure_Download_Proxy.php?file={R:1}" />
    </rule>
  </rules>
</rewrite>

Default value FALSE (not enabled)

Versions ESSENTIALS, PROFESSIONAL, INTEGRATE, CUSTOMERS (SYNC, INTRANET)

Visit the website https://www.wpo365.com/