內容簡介
Folio Gatehouse 讓您可以透過限制特定 WordPress 使用者角色的存取權限，來保護上傳目錄中的檔案。檔案是透過 PHP 提供，網頁伺服器不會直接交付檔案，從而阻止直接的 URL 存取。
【主要功能】
• 區域保護：定義命名區域並分配可存取角色
• 自訂拒絕畫面：為被阻擋的使用者創建 HTML 頁面
• 登入重定向短碼：安全的登入連結，認證後返回原請求檔案
• 可瀏覽檔案清單：為授權使用者提供可下載的檔案清單
• 存取日誌：記錄每個請求的時間戳、使用者名稱等資訊
• 角色管理：直接從外掛創建和管理自訂 WordPress 角色
外掛標籤
開發者團隊
原文外掛簡介
Folio Gatehouse lets you protect files inside your uploads directory by restricting access to specific WordPress user roles. Files are served through PHP — the web server never delivers them directly — so direct URL access is blocked regardless of link sharing.
Key features:
Zone-based protection — define named zones (subfolders inside your uploads directory) and assign allowed roles to each
Custom denial screens — create HTML pages shown to blocked users, with full control over styling and messaging; separate screens for anonymous and logged-in users
Redirect on denial — optionally redirect denied users to any URL (e.g. a sales page or membership signup) instead of showing a denial screen
Login redirect shortcode — [rbfa_login_link] inserts a secure login link that returns the user to the originally-requested file after authentication, using an opaque token so no file path is exposed in the URL
Zone virtual pages — each zone automatically gets a front-end page at /protected-zone/{slug}/ with customisable title and body content, rendered inside your active theme
Browsable file listing — [rbfa_files] shortcode renders a collapsible, downloadable file listing for authorised users, with per-directory file counts, sizes, and ZIP download buttons
Access logging — every request is logged with timestamp, username, IP, file path, and status; filterable, sortable, and exportable as CSV
Role management — create and manage custom WordPress roles (fgh_ prefix) directly from the plugin, with searchable member management
.htaccess integrity — automatically writes and repairs rewrite rules across all protected directories; optional hourly cron
NGINX support — dedicated tab generates ready-to-copy location blocks when NGINX is detected
Export / Import — back up and transfer zones, roles, denial screens, and settings as a JSON file; conflict resolution on import
Security
Files served through PHP (readfile) — web server never delivers protected files directly
Path traversal blocked by realpath() boundary check before any file is served
Login redirect tokens are opaque — no file path, role, or zone information in the URL
Denial screen HTML filtered through a strict wp_kses allowlist on save and read-back
CSRF protection on every form via WordPress nonces
All ORDER BY clauses use a server-side whitelist to prevent SQL injection
Requirements
Apache with mod_rewrite enabled, or NGINX (with manual server block configuration — see the NGINX Config tab)
