{"id":4770,"date":"2022-08-01T12:09:35","date_gmt":"2022-08-01T16:09:35","guid":{"rendered":"https:\/\/learndash.com\/support\/docs\/developers\/protecting-files\/"},"modified":"2026-02-05T17:16:40","modified_gmt":"2026-02-05T22:16:40","password":"","slug":"protecting-files","status":"publish","type":"docs","link":"https:\/\/learndash.com\/support\/kb\/resources\/developers\/protecting-files\/","title":{"rendered":"Protecting Files"},"content":{"rendered":"\n<p>In some situations, only specific users should be able to download or access files on a website. File protection helps prevent direct access to sensitive files while still allowing LearnDash features to function as intended. LearnDash stores certain files in the following directory on the web server:<\/p>\n\n\n\n<p><code>\/wp-content\/uploads\/learndash<\/code><\/p>\n\n\n\n<p>These files may include exports or other system-generated assets that should not be publicly accessible.<\/p>\n\n\n\n<p>The most common way to protect these files depends on the web server in use:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Apache servers use an <strong><code>.htaccess<\/code><\/strong> file<\/li>\n\n\n\n<li>Nginx servers use rules inside a <strong>server configuration file<\/strong><\/li>\n<\/ul>\n\n\n\n<h2 class=\"wp-block-heading\" id=\"h-protecting-files-on-apache-servers\">Protecting Files on Apache Servers<\/h2>\n\n\n\n<h3 class=\"wp-block-heading\" id=\"h-how-it-works\">How It Works<\/h3>\n\n\n\n<p>Apache allows directory-level access control using an <code>.htaccess<\/code> file. This file is placed directly inside the directory that needs protection.<\/p>\n\n\n\n<p>When configured, the server blocks direct access to files in that directory.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\" id=\"h-steps\">Steps<\/h3>\n\n\n\n<ol class=\"wp-block-list\">\n<li>Locate the directory that should be protected (for example:<br><code>\/wp-content\/uploads\/learndash<\/code>).<\/li>\n\n\n\n<li>Create a file named <code>.htaccess<\/code> inside that directory.<\/li>\n\n\n\n<li>Add the following rules to the file:<\/li>\n<\/ol>\n\n\n\n<pre class=\"wp-block-code\"><code>Order Allow,Deny\nDeny from all\n<\/code><\/pre>\n\n\n\n<p>These rules prevent files in the directory from being downloaded or accessed directly via a browser.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\" id=\"h-additional-resources\">Additional Resources<\/h3>\n\n\n\n<p>For a full overview of <code>.htaccess<\/code> functionality and supported directives, refer to the official Apache documentation:<br><a href=\"https:\/\/httpd.apache.org\/docs\/2.4\/howto\/htaccess.html\">https:\/\/httpd.apache.org\/docs\/2.4\/howto\/htaccess.html<\/a><\/p>\n\n\n\n<h2 class=\"wp-block-heading\" id=\"h-protecting-files-on-nginx-servers\">Protecting Files on Nginx Servers<\/h2>\n\n\n\n<h3 class=\"wp-block-heading\" id=\"h-how-it-works-0\">How It Works<\/h3>\n\n\n\n<p>Nginx does not use per-directory configuration files like <code>.htaccess<\/code>. Instead, access rules are managed from a central server configuration file.<\/p>\n\n\n\n<p>Directory protection is handled using <code>location<\/code> blocks.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\" id=\"h-basic-rule-example\">Basic Rule Example<\/h3>\n\n\n\n<p>To deny access to a specific directory, add the following rules to the appropriate server configuration file:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>deny all;\nreturn 403;\n<\/code><\/pre>\n\n\n\n<p>This configuration blocks all direct access and returns a <strong>403 Forbidden<\/strong> response.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\" id=\"h-learndash-export-directory-example\">LearnDash Export Directory Example<\/h3>\n\n\n\n<p>To protect files generated by the LearnDash Import\/Export feature, add the following block:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>location \"\/wp-content\/uploads\/learndash\/export\" {\n    deny all;\n    return 403;\n}\n<\/code><\/pre>\n\n\n\n<p>This ensures exported LearnDash files cannot be accessed directly from the browser.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\" id=\"h-additional-resources-0\">Additional Resources<\/h3>\n\n\n\n<p>For a full overview of Nginx configuration options, refer to the official Nginx documentation:<br><a href=\"https:\/\/www.nginx.com\/resources\/wiki\/start\/topics\/examples\/full\/\">https:\/\/www.nginx.com\/resources\/wiki\/start\/topics\/examples\/full\/<\/a><\/p>\n\n\n\n<h2 class=\"wp-block-heading\" id=\"h-server-file-protection-vs-rest-api-access-learndash-5-0\">Server File Protection vs REST API Access (LearnDash 5.0)<\/h2>\n\n\n\n<p>Server-level file protection applies only to direct file downloads. It does not affect access through the LearnDash REST API.<\/p>\n\n\n\n<p>Key points:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Server rules (<code>.htaccess<\/code> or Nginx) block direct file URLs<\/li>\n\n\n\n<li>REST API endpoints remain available at:<br><code>\/wp-json\/ldlms\/v2\/<\/code><\/li>\n\n\n\n<li>API access is controlled by REST permissions, not server file rules<\/li>\n\n\n\n<li>Tools using WP Application Passwords authenticate through the REST API<\/li>\n<\/ul>\n\n\n\n<p>File protection and API permissions work independently and should be configured based on the access requirements of the site.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\" id=\"h-next-steps\">Next Steps<\/h2>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Review REST API permissions separately if API access needs to be restricted<\/li>\n\n\n\n<li>Confirm the server type (Apache or Nginx) with the hosting provider<\/li>\n\n\n\n<li>Test file access after applying rules to ensure LearnDash features continue working as expected<\/li>\n<\/ul>\n\n\n\n<p><\/p>\n","protected":false},"excerpt":{"rendered":"<p>In some situations, only specific users should be able to download or access files on a website. File protection helps prevent direct access to sensitive files while still allowing LearnDash features to function as intended. LearnDash stores certain files in the following directory on the web server: \/wp-content\/uploads\/learndash These files may include exports or other&#8230;<\/p>\n","protected":false},"author":25,"featured_media":0,"comment_status":"closed","ping_status":"closed","template":"","meta":{"_helpful_status":1,"_kad_blocks_custom_css":"","_kad_blocks_head_custom_js":"","_kad_blocks_body_custom_js":"","_kad_blocks_footer_custom_js":"","_swpsp_post_exclude":false,"_kad_post_transparent":"","_kad_post_title":"","_kad_post_layout":"","_kad_post_sidebar_id":"","_kad_post_content_style":"","_kad_post_vertical_padding":"","_kad_post_feature":"","_kad_post_feature_position":"","_kad_post_header":false,"_kad_post_footer":false,"footnotes":""},"doc_category":[217],"doc_tag":[],"knowledge_base":[157],"class_list":["post-4770","docs","type-docs","status-publish","hentry","doc_category-developers","knowledge_base-resources"],"year_month":"2026-04","word_count":470,"total_views":"2368","reactions":{"happy":"0","normal":"0","sad":"0"},"author_info":{"display_name":"jack","author_link":"https:\/\/learndash.com\/support\/author\/jack\/"},"doc_category_info":[{"term_name":"Developers","term_url":"https:\/\/learndash.com\/support\/kb\/resources\/developers\/"}],"doc_tag_info":[],"taxonomy_info":{"doc_category":[{"value":217,"label":"Developers"}],"knowledge_base":[{"value":157,"label":"Resources"}]},"featured_image_src_large":false,"comment_info":0,"knowledge_base_info":[{"term_name":"Resources","term_url":"https:\/\/learndash.com\/support\/kb\/resources\/","term_slug":"resources"}],"knowledge_base_slug":["resources"],"_links":{"self":[{"href":"https:\/\/learndash.com\/support\/wp-json\/wp\/v2\/docs\/4770","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/learndash.com\/support\/wp-json\/wp\/v2\/docs"}],"about":[{"href":"https:\/\/learndash.com\/support\/wp-json\/wp\/v2\/types\/docs"}],"author":[{"embeddable":true,"href":"https:\/\/learndash.com\/support\/wp-json\/wp\/v2\/users\/25"}],"replies":[{"embeddable":true,"href":"https:\/\/learndash.com\/support\/wp-json\/wp\/v2\/comments?post=4770"}],"version-history":[{"count":8,"href":"https:\/\/learndash.com\/support\/wp-json\/wp\/v2\/docs\/4770\/revisions"}],"predecessor-version":[{"id":11244,"href":"https:\/\/learndash.com\/support\/wp-json\/wp\/v2\/docs\/4770\/revisions\/11244"}],"wp:attachment":[{"href":"https:\/\/learndash.com\/support\/wp-json\/wp\/v2\/media?parent=4770"}],"wp:term":[{"taxonomy":"doc_category","embeddable":true,"href":"https:\/\/learndash.com\/support\/wp-json\/wp\/v2\/doc_category?post=4770"},{"taxonomy":"doc_tag","embeddable":true,"href":"https:\/\/learndash.com\/support\/wp-json\/wp\/v2\/doc_tag?post=4770"},{"taxonomy":"knowledge_base","embeddable":true,"href":"https:\/\/learndash.com\/support\/wp-json\/wp\/v2\/knowledge_base?post=4770"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}