拒绝直接访问文件夹中的文件

Question

My client has a requirement:

1. She wants to create private pages in wordpress with embedded media files (images or videos)
2. User should not be able to download those media files directly by using the urls but those image should be shown on the private pages.

I know I can make pages private and put a password on folder using .htaccess but have no idea about the points above. The site is on Linux Server.

Any idea about this?

Answer 1

With .htaccess there is a way to check the REFERRER. This should match your domain (or a folder for that instance).

RewriteEngine On
RewriteCond %{HTTP_REFERER} !mydomain\.com/page
RewriteRule ^ - [L,F]

You should add this in a new .htaccess of the folder you wish to protect. Although, this is not foolproof. REFERRERS can be spoofed.