Private media for WordPress: protect PDFs and images from direct URL access so only logged-in users can open them. Apache rules + Nginx snippet.