Folio Gatehouse Wordpress Plugin - Rating, Reviews, Demo & Download
Plugin Description
Folio Gatehouse lets you protect files inside your uploads directory by restricting access to specific WordPress user roles. Files are served through PHP — the web server never delivers them directly — so direct URL access is blocked regardless of link sharing.
Key features:
- Zone-based protection — define named zones (subfolders inside your uploads directory) and assign allowed roles to each
- Custom denial screens — create HTML pages shown to blocked users, with full control over styling and messaging; separate screens for anonymous and logged-in users
- Redirect on denial — optionally redirect denied users to any URL (e.g. a sales page or membership signup) instead of showing a denial screen
- Login redirect shortcode —
[rbfa_login_link]inserts a secure login link that returns the user to the originally-requested file after authentication, using an opaque token so no file path is exposed in the URL - Zone virtual pages — each zone automatically gets a front-end page at
/protected-zone/{slug}/with customisable title and body content, rendered inside your active theme - Browsable file listing —
[rbfa_files]shortcode renders a collapsible, downloadable file listing for authorised users, with per-directory file counts, sizes, and ZIP download buttons - Access logging — every request is logged with timestamp, username, IP, file path, and status; filterable, sortable, and exportable as CSV
- Role management — create and manage custom WordPress roles (
fgh_prefix) directly from the plugin, with searchable member management .htaccessintegrity — automatically writes and repairs rewrite rules across all protected directories; optional hourly cron- NGINX support — dedicated tab generates ready-to-copy
locationblocks when NGINX is detected - Export / Import — back up and transfer zones, roles, denial screens, and settings as a JSON file; conflict resolution on import
Security
- Files served through PHP (
readfile) — web server never delivers protected files directly - Path traversal blocked by
realpath()boundary check before any file is served - Login redirect tokens are opaque — no file path, role, or zone information in the URL
- Denial screen HTML filtered through a strict
wp_ksesallowlist on save and read-back - CSRF protection on every form via WordPress nonces
- All
ORDER BYclauses use a server-side whitelist to prevent SQL injection
Requirements
- Apache with
mod_rewriteenabled, or NGINX (with manual server block configuration — see the NGINX Config tab)
Screenshots
No screenshots provided
