How to protect member-only downloads in WordPress

Decide which membership levels can download each file. You may give every active member access, or reserve files for higher levels. Also decide whether people without access should see a locked download, a sign-up message, or nothing at all.

Do not treat a hidden button as protection. A normal Media Library URL can still be opened directly if somebody has copied it, so the file request itself needs an access check.

You can restrict the page containing your download links with a membership plugin, but that only hides the links. It does not automatically protect files already stored at public URLs in wp-content/uploads. This shortcut is acceptable only for non-sensitive files where link hiding is enough.

For paid course material, client documents, software, PDFs, or anything members should not share publicly, use protected file delivery rather than relying on page restriction alone.

For a small site, the manual route can be fine if your membership plugin provides protected files and you are comfortable adding a small customisation. In Paid Memberships Pro, go to Memberships > Settings > Security, find the restricted files directory, create a subfolder such as premium-downloads, and upload the files there rather than to a normal public media URL.

Then add a custom plugin or Code Snippets entry that uses the confirmed pmpro_can_access_restricted_file filter and checks the member with pmpro_hasMembershipLevel(). Replace the example level IDs with your own. This route keeps the source file in the protected directory, but you must maintain the code and access rules yourself.

For a larger library, add each file as a download in Download Monitor instead of linking to the Media Library file. Create the download from Downloads > Add New, add the file under its downloadable files or versions area, and publish it.

On the download’s rules area, select the membership-level group supplied by the integration, choose the permitted level, and set Can Download to yes. Add a final rule denying access to anyone else. Download-specific rules take priority over global rules, so check both if a file behaves unexpectedly.

Create a page for visitors who do not meet the rule. If you are using Download Monitor’s access-management workflow, add its confirmed [dlm_no_access] shortcode to that page, then choose the page under Downloads > Settings > Advanced. Set a clear message explaining whether the visitor should log in, join, or upgrade.

Do not leave the fallback response vague. Members often reach it because they are logged out in another browser, their subscription has expired, or a rule was assigned to the wrong level.

Test every protected download in four states: logged out, logged in with the wrong level, logged in with the correct level, and a member whose access has expired. In each case, open the download URL directly, not only the page containing the button.

Also test a copied old URL, a private browser window, and any cache or CDN layer. The common Friday failure is that the page is restricted but the original upload URL still works, or a cache serves a previously authorised response to somebody else. If direct access succeeds for an unauthorised visitor, move the file into the protected delivery system and purge the relevant caches.

If you already use Paid Memberships Pro and Download Monitor, the Paid Memberships Pro – Download Monitor Integration Add On is the faster route. It connects Download Monitor’s file rules with PMPro membership levels, so you can assign access from the download settings instead of maintaining custom file-delivery code.

Use the manual route for a small number of files and a simple rule set. Choose the integration when you need many downloads, different membership tiers, download tracking, or a no-access flow that administrators can manage from WordPress.