MediaKnight

WordPress serves Media Library files directly from the uploads folder. A login on the page does not apply to the file's own URL. MediaKnight moves a protected file out of that public path, so the direct link stops working for visitors while logged-in users can still open it.

Yes, with a server rule. Nginx does not read .htaccess files. MediaKnight generates a site-specific snippet; your host adds it to the existing server block, validates with nginx -t and reloads. Then run Check server protection again. Without that rule, protection is not active on Nginx.

After you protect a file, its old direct link no longer works for visitors. The blocked-file page does not show the file name or internal path; a refused download or direct protected path keeps status 403. Use the shown download URL or insert an image again. Existing hard-coded URLs in posts are not rewritten. Administrators get no exception to the chosen access rule.

No. Manual protection, access rules, server checks and downloads remain free. There is no license server or account requirement for these functions.

The plugin moves the file and its registered WordPress variants into wp-content/uploads/mediaknight/, updating attachment metadata. The originals leave the public path. Download URLs go through WordPress access checks. The attachment stays in the Media Library. Copies created outside registered metadata are not tracked.

MediaKnight recreates its own helper files automatically, but it cannot recreate your protected media: those files are stored only in wp-content/uploads/mediaknight/, so deleting the folder deletes them. MediaKnight then reports the missing files on the MediaKnight and Media Library screens; it never moves, replaces or invents files to fill the gap. Keep regular backups that include this folder and restore it from your backup if needed. Cleanup, optimization, cache and security plugins must not delete or "clean" this folder or its .htaccess file; exclude it in their settings.

Deactivation keeps protected files blocked; reactivate the base plugin to resume downloads. Uninstall restores media to their original directory and removes plugin settings, metadata and generated Apache rules. Restored files become public. Media files are never deleted by uninstall. On conflicts or interrupted moves, uninstall stops for recovery; see docs/DEVELOPMENT.md. Remove manual Nginx rules only after successful restoration.

Role selection is supplied by the separate Pro extension. Existing saved role rules remain enforced without Pro. Keep the existing restriction when saving an attachment to preserve both access and existing links. Switching to logged-in access or public explicitly broadens access.

The free protection and access rules keep working. Existing signed links keep their original expiry, click limit and access rules, and can be revoked in the base plugin. If automatic protection was enabled and its extension is inactive, new uploads are stopped to prevent accidental publication. Settings offers an explicit action to disable automatic protection; existing files remain protected.

Local WordPress uploads only. No offload, S3/R2, watermarking, file sales, membership/form integration or document portal in v1. Hosting execution limits apply to large downloads. Multipart ranges are rejected. Active file types are served as downloads. Previously downloaded/cached copies cannot be recalled. Protection must be enforced on every host serving uploads. A failed anonymous loopback/TLS check blocks new protection until hosting is fixed.

It stores attachment protection settings and site settings locally. Existing signed-link records contain expiration and click counters. Approximate rate limiting uses a salted hash of the connecting IP in a transient expiring after 120 seconds; the plugin does not store raw IP addresses. Expired database entries may remain until WordPress cleanup. The server check requests a harmless temporary file on your own configured uploads URL without login cookies. Free activation and ordinary free protection do not initialize the optional Freemius connection. Optional public error-page branding uses only bundled assets. WordPress authentication and hosting access logs are separate. The MediaKnight uninstall routine makes no network request. The optional savings meter is off by default. Only after you switch it on, it records per day, locally in its own database tables, which external domains tried to load files from your site. This data is not sent anywhere.

Packages with the Freemius SDK offer a voluntary Pro connection in Settings > MediaKnight. Nothing is sent to Freemius unless you explicitly continue, the server protection check succeeds and you then opt in on the Freemius connection screen (you can also skip). Only after that opt-in, or after starting a trial or activating a license, the SDK contacts api.freemius.com for connection, trial, purchase, licensing and premium updates. The connection screen lists the permissions requested. Per Freemius' data practices this covers the opted-in administrator's name and email address, the site URL, plugin version and state (active, inactive, uninstalled), WordPress and PHP versions and site language; the data is re-synced at most daily when it changes. The list of installed plugins/themes is a separate optional permission: our configuration sets it off by default, and the connection screen shows a switch so you decide. Our configuration also sets the SDK newsletter permission off; the SDK's standard connection text may still mention update/offer emails, so only opt in if you agree with the text shown. Connected sites receive periodic licensing/update checks. MediaKnight does not attach media files, protected URLs or visitor records to this integration. Free protection does not require connecting or paying. Freemius provides its own account/disconnection controls after connection. If you buy or trial Pro under the Freemius route, checkout runs on checkout.freemius.com. Freemius acts as the authorized reseller and merchant of record for that sale (payment processing, VAT/sales tax and invoice); name, email and billing details you enter there go directly to Freemius. For opt-in usage and licensing data, Freemius acts on behalf of the plugin owner as data processor, as described in its data practices. Service: https://freemius.com/ Terms: https://freemius.com/terms/ Privacy: https://freemius.com/privacy/ Data practices: https://freemius.com/privacy/data-practices/

Use this plugin's WordPress.org support forum. Include the relevant error message and server type when useful, but never post passwords, license credentials, private file URLs or customer documents. The separate Pro extension also offers a voluntary feedback form and optional departure question.

MediaKnight limits access to files in your uploads folder. It cannot control copies already held by a CDN or cache, or server rules it cannot write (on Nginx your host must apply them). Run Check server protection again after server changes. Keep your own backups. MediaKnight is not a complete security solution and is provided without a guarantee that files can never be accessed without authorisation. Highly sensitive files do not belong in a publicly reachable uploads folder, even with MediaKnight.

No. This plugin controls access to supported media files. It does not certify legal compliance or prevent an authorized recipient from copying a downloaded file.