Secure serving and server setup

How a download link works

A download link, such as example.com/download/press-kit/ (or example.com/?fileline=12 with plain permalinks), never shows where the file is. When it's followed, Fileline:

1. finds the download and the version asked for (the latest by default);
2. checks who may download it (members only, and any rules from Fileline Pro);
3. counts the download (see Counting and privacy);
4. sends the file, or redirects to an external file's address.

Files are sent with their type (Content-Type), size (Content-Length) and name (Content-Disposition, with the original name kept for modern browsers), in 1 MB chunks so big files don't use up the server's memory. Browsers and download managers can resume a download (range requests); the resumed parts aren't counted again.

Files are only ever sent from the uploads folder, so a link can never serve anything else from your server. PHP files, hidden files (such as .env), logs, database dumps and backups are never sent, and WooCommerce's product files (uploads/woocommerce_uploads) only to people who manage the shop.

The protected folder

Files uploaded in a download's Versions box go into wp-content/uploads/fileline/ (in year and month folders, like the rest of your uploads). The folder holds:

• an .htaccess file that refuses every direct request on Apache and LiteSpeed, except the thumbnails WordPress makes (in the size set under Settings → Media), so they still show in the Media Library;
• a web.config file that refuses every direct request on IIS;
• an index.php file, so the folder can't be listed.

Images and PDFs uploaded there get only a thumbnail, no medium or large copies, so no near full-size copy is public. An image whose name looks like a thumbnail (logo-150x150.png) is saved as logo-150x150-file.png, so it can't pass for one.

If WordPress can't write these files (the uploads folder isn't writable), uploads go to the usual uploads folder instead, and the Versions box doesn't mark them protected.

Under Downloads → Settings → Protected folder, click Check the protection: Fileline puts a test file in the folder and tries to open it by its address, then tells you whether that was refused. If the test file can't be written, the check says it couldn't run.

nginx

nginx doesn't read .htaccess files. Add the rule shown on the settings screen to your site's server block, for example:

location ^~ /wp-content/uploads/fileline/ {
	location ~* "-(150x150)\.(jpe?g|png|gif|webp|avif)$" {
		allow all;
	}
	deny all;
}

The 150x150 part is your thumbnail size; the settings screen shows the rule with yours. On managed hosting, send this to your host's support. Then run the check again.

IIS

The folder's web.config uses IIS's Request Filtering, which IIS includes and lets folders set by default, to refuse every request for a file in the folder. It can't tell thumbnails apart, so on IIS the protected files show no preview in the Media Library. If the check says the files can be opened, ask your host to make sure Request Filtering is installed and may be set in web.config files.

Sending big files faster

By default PHP sends the file, which works everywhere. If your server supports it, let the web server do it after Fileline has checked and counted the download:

Setting	Server	What to set up
X-Sendfile	Apache with mod_xsendfile, LiteSpeed, Lighttpd	Apache: install mod_xsendfile and allow the uploads folder (XSendFilePath /path/to/wp-content/uploads). LiteSpeed supports it natively.
X-Accel-Redirect	nginx	An internal location that points at the uploads folder. The settings screen shows it with your paths, for example location /fileline-protected/ { internal; alias /var/www/html/wp-content/uploads/; }

Choose it under Downloads → Settings → Send files with. If downloads come out empty after switching, the server doesn't support the method: switch back to PHP.

Opening files in the browser

Tick Open PDFs, images, audio and video in the browser to have those shown in the browser instead of saved. Other files are always saved.

External files

A version with a file address redirects the visitor there after counting. The address is visible to the visitor once they're redirected, so use this for files that may be public anyway (a CDN, a public release).