How to restrict downloads to members on WordPress
WordPress does not protect a Media Library file just because its page is members-only. For real member-only downloads, store the file behind authenticated delivery; the practical fast route is a membership downloads add-on such as Paid Memberships Pro Downloads.
- 01Decide who gets each file
- 02Choose the manual protection route
- 03Do not link public media files
- 04Create the members download area
- 05Test every access path
- 06Use the fast membership route
What you need
- A WordPress membership system with active member accounts
- Administrator access to WordPress and your hosting account
- The files you want to protect
- A test member account and a non-member browser session
Decide who gets each file
List the membership levels or roles that should access each download. Separate files by entitlement, such as Gold PDFs, course worksheets, or downloads available to every logged-in member.
Do not rely on hiding a button or protecting the page that contains it. A normal file uploaded to the Media Library has a public URL, and someone who obtains that URL may still reach the file directly.
Choose the manual protection route
WordPress core does not provide a complete member-only file delivery system. The manual route requires you to keep protected files outside the publicly accessible uploads area, block direct web access at the server level, and deliver each file through code that checks the visitor's login and membership before sending it.
This is reasonable for a developer who controls the server and can maintain the delivery code. It is not a good Friday-afternoon fix for a live membership site: a misplaced file, server rule, cache, or CDN URL can expose the download. Membership documentation also notes that direct download protection depends on server configuration rather than PHP alone.
Do not link public media files
Upload protected files through the private delivery system you selected, not through the ordinary Media Library followed by a copied File URL. Put only the protected download link or download block on the members' page.
If you already used public Media Library URLs, replace those links and check the old URLs in a logged-out browser. A members-only page can be restricted while the underlying PDF or video remains publicly reachable.
Create the members download area
Create a page that lists the resources members are allowed to use. Group files by membership level or course, and show a useful title and description rather than exposing a confusing filename.
Restrict the page itself as well as the files. Page restriction improves navigation and prevents non-members from seeing the library, but remember that page restriction is an extra layer, not a replacement for protected file delivery.
Test every access path
Test each file while logged out, as a member with the correct level, and as a member with the wrong level. Also paste the download URL into a private browser window after logging out. The expected result is a denial or membership prompt for unauthorised users, and a file download for the permitted member.
Check caching too. A page cache or CDN can serve a member's response to a non-member if private pages or responses are cached incorrectly. Exclude member pages and protected download responses from caching, then clear existing caches.
Use the fast membership route
For most sites, use Paid Memberships Pro with its Downloads Add On. In WordPress, install and activate the add-on from Memberships > Add Ons, create a download, upload the file through the download editor, and select the membership levels allowed to access it.
The add-on stores files in a protected directory rather than the standard uploads folder and provides a download block, library block, or shortcode for your members' page. If no level is selected, the file is available to all logged-in users, so check that setting before publishing.
Let Paid Memberships Pro do it
Restricts files by membership level, making it a fit for protected ebooks, videos, PDFs, and other member-only downloads.
Sources
- woocommerce.com /document/woocommerce-memberships-faq/
- wordpress.org /support/topic/media-not-restricted/?utm_source=openai
- paidmembershipspro.com /add-ons/pmpro-downloads/
Questions
- Can I restrict a PDF by protecting the WordPress page containing it?
- No. Page restriction does not by itself protect the PDF's direct URL. A visitor may bypass the page and request a file stored in the public uploads area, which is why the file must be stored behind an authenticated delivery system or protected at the server level.
- Can WordPress restrict Media Library files without a plugin?
- Not as a complete built-in feature. You can build a custom solution with private storage, server rules, and an authenticated download handler, but that requires development and hosting access. WordPress page permissions alone are not enough for member-only PDFs, videos, ZIP files, or audio.
- What happens if a member shares the download URL?
- A properly protected download checks the visitor's current permissions when the URL is requested, so a shared link should still fail for a non-member. This does not stop a permitted member from copying the file after downloading it, and it does not protect files accidentally left in a public uploads directory.
- Why can non-members sometimes see protected downloads?
- Caching is a common cause. A page or response generated for a logged-in member can be reused for a logged-out visitor when the cache is not configured for membership content. Exclude member pages and protected responses from page, object, and CDN caching, then retest in a private browser window.
- Can I give different downloads to different membership levels?
- Yes. Assign each download to the membership levels that should access it, then place the appropriate downloads on the relevant member pages. Paid Memberships Pro's Downloads Add On uses its normal membership restriction system and lets you select the permitted levels for each download.