Restrict access to folder inside public_html

Question

I am currently making a WordPress user system, that is supposed to feature private files, that can be uploaded to each user. In order to achieve this, I am using a filter that places the files in question in a subfolder to uploads named secretfiles. The filter won't allow me to place the files outside the public_html, so I have to do it this way.

Now I am planning to exclude all access to the this 'secretfiles' folder using .htacces, and write a downloadscript that checks whether a user is allowed to download requested files, before sending them to him.

Would this be a safe way to make the files truly private, even though they are placed inside the public_html folder. And what would my .htaccess code be?

Thanks!

Answer 1

You can deny all access from directly accessing the files in a directory using an .htaccess file (see below example). Users can still access this files if they have been enclosed in a download script as suggested. Note, that the download script should not be a redirection. It should send the file itself.

Deny from all