Title: Protect Uploads Author: Protect Uploads Published: 31. März 2015 Last modified: 7. Oktober 2026 --- Plugins suchen ![](https://ps.w.org/protect-uploads/assets/banner-772x250.png?rev=2779778) ![](https://ps.w.org/protect-uploads/assets/icon-256x256.png?rev=2779778) # Protect Uploads Von [Protect Uploads](https://profiles.wordpress.org/alticreation/) [Herunterladen](https://downloads.wordpress.org/plugin/protect-uploads.0.8.0.zip) * [Details](https://de.wordpress.org/plugins/protect-uploads/#description) * [Rezensionen](https://de.wordpress.org/plugins/protect-uploads/#reviews) * [Installation](https://de.wordpress.org/plugins/protect-uploads/#installation) * [Entwicklung](https://de.wordpress.org/plugins/protect-uploads/#developers) [Support](https://wordpress.org/support/plugin/protect-uploads/) ## Beschreibung The uploads directory is where the files of the WordPress media library are stored. Unfortunately, this directory is not protected by default: anyone who wants to see your whole library may be able to list it by going to http://yourwebsite/wp-content/ uploads. This plugin hides the contents by adding an index.php file to your uploads directory and its subfolders, or by adding an .htaccess file that returns a 403 error (Forbidden Access). * Depending on your server, the .htaccess option may be unavailable (Nginx does not read .htaccess files). For more information, visit [protectuploads.com](https://protectuploads.com). **Features:** * **Directory Protection**: Stop visitors from browsing your uploads directory ( index.php or .htaccess 403). New year and month folders are protected as files are uploaded to them. * **Password Protection**: Secure individual media files with passwords. Multiple passwords can be set for each file with custom labels. On Apache and LiteSpeed, the file’s direct URL also asks for the password, and repeated wrong guesses are rate limited. * **Image Watermarking**: Add text watermarks to your uploaded images with customizable position, opacity, and font size. An untouched copy of each original is kept. * **Right-Click Protection**: Discourages casual copying: disables the right-click menu and dragging on images. Determined visitors can still save images. * **Access Logging**: See when password-protected files were downloaded, with which password and from which IP address. * **Site Health Checks**: Built-in protection status tests with actionable advice. Need more protection? [Protect Uploads Pro](https://protectuploads.com) adds Secure Send (emailed files released by a one-time code), a Client Portal, file requests, expiring and single-use passwords, role-based access, hotlink protection, logo and bulk watermarks, and download analytics. Available languages: * English * Français * Español * Italian (thanks to Marko97) ## Screenshots [⌊The Directory Protection tab, with the protection status of each uploads folder.⌉⌊ The Directory Protection tab, with the protection status of each uploads folder.⌉[ The Directory Protection tab, with the protection status of each uploads folder. [⌊The Password Protection box on a media file's edit screen.⌉⌊The Password Protection box on a media file's edit screen.⌉[ The Password Protection box on a media file’s edit screen. [⌊The Image Protection tab: password protection, watermark and right-click options.⌉⌊ The Image Protection tab: password protection, watermark and right-click options .⌉[ The Image Protection tab: password protection, watermark and right-click options. ## Installation 1. Upload `protect-uploads` folder to the `/wp-content/plugins/` directory 2. Activate the plugin through the ‚Plugins‘ menu in WordPress 3. Configure protection options in Media Protect Uploads Note: watermarking needs the PHP GD extension. The .htaccess method and the direct- URL password rules need a server that reads .htaccess files (Apache or LiteSpeed) and a writable uploads directory. ## FAQ ### How do I add a password to a media file? 1. Enable password protection in Media Protect Uploads, on the Image Protection tab 2. Open any media file’s edit screen (Media Library, select the file, then „Edit more details“) 3. Find the „Password Protection“ box in the sidebar 4. Add one or more passwords with descriptive labels ### How does watermarking work? When enabled, watermarking automatically adds text to images when they are uploaded. You can customize: – The watermark text (defaults to your site name) – Position( top-left, top-right, bottom-left, bottom-right, center) – Opacity (0-100%) – Font size (small, medium, large) The watermark is applied to new uploads only. Animated GIFs are left unchanged. ### Does watermarking change my original images? Yes: the watermark is drawn on the uploaded file itself, so every size WordPress generates from it carries the mark. Before drawing it, the plugin keeps an untouched copy of the original in wp-content/uploads/protect-uploads-originals/, in the same year/month folders. That folder is blocked from web access on Apache and LiteSpeed; on Nginx each copy has a random name so its URL cannot be guessed. Deleting a media file deletes its copy. Deleting the plugin keeps the copies, since they may be your only originals. ### Can I password protect only certain file types? You choose files one by one: any media file, including PDFs, images, videos and documents, can have its own passwords. ### Does a password protect the file’s direct URL? On Apache and LiteSpeed, yes: the plugin adds rules to the uploads .htaccess file that send the file’s direct URL to the password prompt. Nginx does not read .htaccess files, so there the password protects the links WordPress shows but the file itself stays reachable at its uploads URL. The password box on the media screen tells you when this applies, and Tools Site Health warns you when protected files are reachable at their direct URL. ### Does this work on Nginx? Partly. The index.php method, watermarking, right-click protection and the password prompt work on any server. Nginx does not read .htaccess files, so the .htaccess method is not available and a password-protected file can still be downloaded at its direct uploads URL by anyone who knows it. To block directory listing on Nginx, also make sure „autoindex“ is off for your uploads directory. ### What does Pro add? [Protect Uploads Pro](https://protectuploads.com) is a paid add-on that works alongside this plugin. It adds logo (image) watermarks, more watermark positions and bulk watermarking of existing images, expiring, single-use and limited-use passwords, expiring download links, role-based access to files, hotlink protection, download analytics, and a Protected Download block. ### What is removed when I delete the plugin? Its settings, its password and access-log tables, the index.php files it created and the rules it added to .htaccess. Untouched copies of watermarked images are kept. ## Rezensionen ![](https://secure.gravatar.com/avatar/135bb06c69cba75b7623f9678c9b22e2a31bd8aadc1de0c1bac975f5697400b8? s=60&d=retro&r=g) ### 󠀁[Thanks!](https://wordpress.org/support/topic/thanks-2497/)󠁿 [marinstratulat](https://profiles.wordpress.org/marinstratulat/) 25. Mai 2024 Thanks! ![](https://secure.gravatar.com/avatar/0ece02f84064b37b72e67462316f8b98d54d2c0df405d8bb8aa7b5dbd9155fcd? s=60&d=retro&r=g) ### 󠀁[Doesn’t work at all](https://wordpress.org/support/topic/doesnt-work-at-all-220/)󠁿 [kmp2](https://profiles.wordpress.org/kmp2/) 15. Mai 2023 1 Antwort Tried with "Protect with index.php files" Tried with "Protect with .htaccess file" Neither one works. PDF happily appears in another browser where I'm not logged in, it's got a little menu, it loads completely, and the crooks are off and away with my property. Wordpress 6.2. Thanks. Have a nice day. ![](https://secure.gravatar.com/avatar/37bf9c3442093bd8647b7028e6c798396188392e3226e1a6520ac9815347aa0a? s=60&d=retro&r=g) ### 󠀁[Don’t be fooled by fake reviews.](https://wordpress.org/support/topic/great-to-use-39/)󠁿 [kyle1313](https://profiles.wordpress.org/kyle1313/) 21. Juni 2023 1 Antwort This plugin is not malware.The 'malware' you claim is a 'fake plug-in' created by a web server being hacked.A year after downloading this plug-in from the official Wordpress.org , my site is still very fine and secure. Don't be fooled by fake reviews. ![](https://secure.gravatar.com/avatar/5f707618e5ae35a00590ac745bf6132897a4c61538092c683a6dea2d64b7951c? s=60&d=retro&r=g) ### 󠀁[Simple and basic but perfect!](https://wordpress.org/support/topic/simple-and-basic-but-perfect/)󠁿 [gianfri](https://profiles.wordpress.org/gianfri/) 13. August 2022 It just does what it has to do. Restrict free browsing of your WP-content folder and subfolder. You can still access a specific file if you have the exact path but you cannot sneak around any longer. ![](https://secure.gravatar.com/avatar/8a7af3abbd8421a35886db26b1dbd82da9e6297dc61baecfd011b1f8115d29b0? s=60&d=retro&r=g) ### 󠀁[Still works great on wp 5.8](https://wordpress.org/support/topic/still-works-great-on-wp-5-8/)󠁿 [anders23b](https://profiles.wordpress.org/anders23b/) 16. Februar 2022 Still works great on wp 5.8 ![](https://secure.gravatar.com/avatar/cf04568e02c18794f6394cf736ad12f09593894d34ef0e79377ba0f5b46b8fbe? s=60&d=retro&r=g) ### 󠀁[Thank you for a great plugin](https://wordpress.org/support/topic/thank-you-for-a-great-plugin-13/)󠁿 [thirty6](https://profiles.wordpress.org/thirty6/) 20. Oktober 2020 Sure, could have done it all manually… but why!? If site maintenance/upkeep/security falls within your purview… This plugin is a must have tool. What makes it good… 1. Out of the box installs with zero compromises or changes to other plugins or server software. 2. Activation and settings are straight forward 3. Works exactally as expected/should Job well done… [ Alle 13 Rezensionen lesen ](https://wordpress.org/support/plugin/protect-uploads/reviews/) ## Mitwirkende und Entwickler „Protect Uploads“ ist Open-Source-Software. Folgende Menschen haben an diesem Plugin mitgewirkt: Mitwirkende * [ Protect Uploads ](https://profiles.wordpress.org/alticreation/) [Übersetze „Protect Uploads“ in deine Sprache.](https://translate.wordpress.org/projects/wp-plugins/protect-uploads) ### Interessiert an der Entwicklung? [Durchstöbere den Code](https://plugins.trac.wordpress.org/browser/protect-uploads/), sieh dir das [SVN-Repository](https://plugins.svn.wordpress.org/protect-uploads/) an oder abonniere das [Entwicklungsprotokoll](https://plugins.trac.wordpress.org/log/protect-uploads/) per [RSS](https://plugins.trac.wordpress.org/log/protect-uploads/?limit=100&mode=stop_on_copy&format=rss). ## Änderungsprotokoll #### 0.8.0 **Security** * Fixed: a password-protected file stayed downloadable at its direct uploads URL. On Apache and LiteSpeed, direct requests for the file, its image sizes and its WebP/AVIF copies now go to the password prompt * Fixed: failed passwords were logged but never limited; 5 failed attempts per visitor per file now lock that visitor out for 15 minutes * Fixed: simultaneous password guesses cannot exceed the attempt limit; successful passwords refund only their own attempt * Fixed: visitor IPs were read from forwarding headers anyone can set; REMOTE_ADDR is used, with a ‚protect_uploads_client_ip‘ filter for sites behind a trusted proxy * Fixed: IPv4-mapped IPv6 addresses use each visitor’s IPv4 limit instead of sharing a single network limit * Fixed: SVG and HTML files are downloaded instead of opened, so they cannot run scripts on your site * Fixed: the protected-file path check could be fooled by „../“ segments or a sibling folder name * Removed: an unused public endpoint that allowed unlimited password guessing **Fixes** * Fixed: links to password-protected files stopped working after a day, or when served from a page cache („Invalid security token“) * Fixed: after entering the password, visitors got the full-size file instead of the image size they asked for * Fixed: password-protected files were read fully into memory; they are now streamed * Fixed: watermarking overwrote the original upload; an untouched copy is now kept in uploads/protect-uploads-originals/, blocked from web access * Fixed: watermarking flattened animated GIFs and stored portrait photos sideways * Fixed: thumbnails of password-protected images were broken in the Media Library * Fixed: the settings page could take minutes to load; it makes one cached check of the uploads URL and shows „Could not verify“ when that check fails * Fixed: new year and month upload folders were not protected by the index.php method * Fixed: messages from saving the settings were lost after the page reloaded * Fixed: removing the index.php protection deleted other plugins‘ index.php files * Fixed: Site Health reported the uploads directory as protected when only password rules were present * Fixed: Site Health marked the empty index.php files that block folder listings( this plugin’s and Protect Uploads Pro’s) as dangerous and told you to remove them * Fixed: deleting the plugin left its settings, tables and .htaccess rules behind( copies of watermarked originals are kept) * Fixed: on Nginx the settings were rewritten on every request * Fixed: with Protect Uploads Pro active, the password rules are written after Pro’s rules **Changes** * Added: Site Health check for password-protected files whose direct URL is not protected, and a notice when the rules cannot be written * Added: protect_uploads_allow_file_download filter before a password-unlocked file is served * Changed: the password box warns when the server cannot protect the direct URL( for example, Nginx) * Changed: right-click protection is described honestly; Pro upgrade texts are accurate, cover Secure Send, the Client Portal and file requests, and link to pricing * Changed: Site Health no longer mentions Protect Uploads Pro on sites where Pro is active * Removed: unused script admin-passwords.js and unused code #### 0.7.1 * Compatibility verified with WordPress 7.1 * Fixed the bundled watermark font: text watermarks now render at the intended size using Open Sans instead of falling back to a small built-in bitmap font #### 0.7.0 * Added Site Health checks: uploads directory browsing protection status, detected server configuration (Apache/Nginx), and a bounded scan for sensitive file types in the uploads directory * Added unobtrusive upgrade hints for Protect Uploads Pro (hidden entirely when Pro is active) * Fixed the settings page title showing the plugin slug instead of the plugin name * Compatibility verified with WordPress 7.0 and PHP 8.3 * Raised minimum requirements to WordPress 5.0 and PHP 7.4 #### 0.6.0 * Added image watermarking with customizable text, position, opacity, and font size * Added right-click protection to prevent image downloads * Added password protection for individual media files * Added access logging for password-protected files * Added multiple password support with custom labels * Added security enhancements throughout the plugin * Improved file serving with better security checks * Added font size control for watermarks * Enhanced error handling and logging #### 0.5.2 * Removed unused css #### 0.4 * Fix potential security issues. * Remove recursive loop that creates indexes. #### 0.3 * Simplify UI admin. * check presence of index.html. * Remove option value managing current protection status. * Reorganizing code and making it more modular and simple. * Remove useless pieces. #### 0.2 * Add security check to form in admin page. * Add sidebar for admin page * Add Italian translation (thanks to Marko97). * Try to fix the wrong message saying that Protection is disabled even though it is actually working. #### 0.1 * Initial release ## Meta * Version **0.8.0** * Zuletzt aktualisiert **vor 5 Tagen** * Aktive Installationen **30.000+** * WordPress-Version ** 5.0 oder höher ** * Getestet bis **7.1.3** * PHP-Version ** 7.4 oder höher ** * Sprache * [English (US)](https://wordpress.org/plugins/protect-uploads/) * Schlagwörter * [directory listing](https://de.wordpress.org/plugins/tags/directory-listing/) [password protection](https://de.wordpress.org/plugins/tags/password-protection/) [private files](https://de.wordpress.org/plugins/tags/private-files/)[security](https://de.wordpress.org/plugins/tags/security/) [watermark](https://de.wordpress.org/plugins/tags/watermark/) * [Erweiterte Ansicht](https://de.wordpress.org/plugins/protect-uploads/advanced/) ## Bewertungen 4.8 von 5 Sternen. * [ 11 5-Sterne-Rezensionen ](https://wordpress.org/support/plugin/protect-uploads/reviews/?filter=5) * [ 0 4-Sterne-Rezensionen ](https://wordpress.org/support/plugin/protect-uploads/reviews/?filter=4) * [ 1 3-Sterne-Rezension ](https://wordpress.org/support/plugin/protect-uploads/reviews/?filter=3) * [ 0 2-Sterne-Rezensionen ](https://wordpress.org/support/plugin/protect-uploads/reviews/?filter=2) * [ 0 1-Sterne-Rezensionen ](https://wordpress.org/support/plugin/protect-uploads/reviews/?filter=1) [Deine Rezension](https://wordpress.org/support/plugin/protect-uploads/reviews/#new-post) [Alle Rezensionen anzeigen](https://wordpress.org/support/plugin/protect-uploads/reviews/) ## Mitwirkende * [ Protect Uploads ](https://profiles.wordpress.org/alticreation/) ## Support Behobene Probleme in den letzten zwei Monaten: 0 von 1 [Support-Forum anzeigen](https://wordpress.org/support/plugin/protect-uploads/)