MediaKnight

Protect media files in WordPress so only logged-in users can open them.

A WordPress page can be members-only, but the PDFs and images on it still live in the Media Library with a public uploads address. Anyone who has that direct link can open the file, share it further, and leaked links can end up in search results.

MediaKnight closes that gap. Protect a file and it moves out of the public uploads path, so the old direct link stops working for visitors. Logged-in users still open it through a WordPress access check, and protected downloads are sent with noindex headers.

You keep working in the normal Media Library: click Protect, done.

Who it’s for

• Client portals: contracts, reports and deliverables only for clients who log in.

• Course and membership material: workbooks, slides and downloads for logged-in students or members. MediaKnight works with WordPress logins; it does not integrate with a specific LMS or membership plugin.

• Internal documents: handbooks, procedures and HR files for your team’s WordPress accounts.

• Invoices and quotes: PDFs your customers open after logging in, not via a forwarded link.

• Photographers: show proofs to clients who log in, without the image files being openable by anyone with the URL.

What the free plugin does

The free plugin works on its own, with no account, payment, trial expiry or file quota.

• Protect and unprotect files from the Media Library list and the attachment editor.

• Logged-in access to protected files, and continued enforcement of previously saved role restrictions.

• Protects registered image sizes, originals and editing backups, not just the main file.

• Check server protection: an anonymous test that confirms the direct link is really blocked on your hosting.

• Apache works out of the box when.htaccess rules are allowed; on Nginx your host adds a short snippet the plugin generates.

• A privacy-safe blocked-file page in the visitor’s supported browser language, with English fallback and optional local MediaKnight branding.

• Controlled downloads with noindex headers and HTTP Range support for large files.

• Interface translations come from translate.wordpress.org language packs; no translation files are bundled with the plugin.

• Safe recovery and revocation of existing signed links from a separate extension or earlier installation.

MediaKnight Pro (optional)

Everything described above is free and stays free: no account, quota or expiry. MediaKnight Pro is a separate add-on for sites that need more control: choose which WordPress roles can open each file, protect files in bulk, protect new uploads automatically, and share temporary, revocable links with optional click limits.

com/mediaknight/#plans

If Pro ends, your saved protection rules stay in place and files remain protected by the free plugin. Existing role restrictions are not broadened to all logged-in users.

org. The free plugin contains no Pro licensing client or locked Pro implementation and does not download/install that extension. The optional Freemius connection and its data sharing are explained below.

Technical details

• Protected files and their registered variants move to wp-content/uploads/mediaknight/ (the mediaknight folder inside your uploads directory); attachment metadata is updated and the attachment stays in the Media Library.

• The files MediaKnight creates are kept in that folder: protected media, its access rule (.htaccess), an empty index.php, a lock file and, only if your host has enabled it, the Apache collector’s working files. Outside that folder, the plugin only adds one marked block to the.htaccess file of the uploads directory on Apache.

• Self-repair: MediaKnight checks its own helper files on normal WordPress requests and recreates them if they are missing. It never overwrites a file it did not create. If a helper cannot be restored, it keeps access closed: its download route returns an error instead of a file, new protection stops and a notice appears on the MediaKnight and Media Library screens.

• Downloads go through WordPress access checks, with HTTP Range streaming. Server requirements for Apache and Nginx, and the cache exclusions, are listed under Installation.