Vanquish Attach Me – Order & Product Attachments for WooCommerce

In a folder inside your uploads directory, three ways round at once. The plugin writes the rules that close a directory to direct access, in the forms Apache and IIS understand. Because nginx honours neither, the path is unguessable as well: each order's files sit under a directory name derived from a secret the plugin generates for your site, rather than from the order number, and every stored file keeps its own name with twelve random characters added. And the way in is the only way in: every download goes through a signed link, which checks whether the person asking placed that order or can manage the shop. There is no switch for any of this. A file attached to an order is private by definition, and an option to serve it insecurely would only ever be turned on by mistake.

Yes. Files are sent to the server in pieces small enough to clear upload_max_filesize and post_max_size, so neither caps what you can attach. The screen shows the maximum it will accept.

Both work. A media library file keeps its own public address in wp-content/uploads — that is how the media library works — so if a file must not be reachable by anyone holding its URL, upload it through the plugin instead of adding it to the library. An external URL is only ever a link: the plugin does not fetch somebody else's file to attach it to your emails.

Yes, with HPOS and with the classic order storage.

No. Your settings, your texts, the files on your products and the files on every order are converted for you. The importer runs from Attach Me → Settings → Import old data, shows how much is left as it goes, and finishes in the background if you close the tab. An order is also converted the first time somebody opens it, whatever happened before. Your files stay where they are on disk and keep working, and the old plugin's download links are still understood. A customer with an account follows one after signing in, and so do you. A link to a guest order's file needs one thing more than the link. Those old URLs were built as ?wcam_id=<order number>-<0, 1, 2...>, which anybody can type out, and a guest order has no account to check the visitor against — so on its own such a link is not proof of anything, and is refused. It works when the request also carries the order key, which is the token WooCommerce puts in the order links it emails: following the file from the customer's own order page works, pasting the bare old URL does not. The old plugin's data is left in place rather than deleted, so nothing is destroyed by importing. You can keep both installed while you check the result, then deactivate the old one.

No. The premium package is the same plugin with more in it. Everything described above under "free features" works the same either way, and the settings you have already made are untouched by activating a licence.

Yes, all of it, under Attach Me → Settings: the box title, the button, the empty message, the email block. With WPML or Polylang active, each text has one input per language.

Nothing of yours is removed. Your settings and your wording stay, the files attached to your orders and products stay, and the files on disk are left alone — so reinstalling puts you back exactly where you were. Only two things go: the plugin's scheduled events, which would otherwise keep firing for a plugin that is no longer installed, and its caches, which would expire on their own anyway.