# Secure serving and server setup - Fileline 1.x documentation

> How download links hide the file's address, the protected folder, Apache, IIS and nginx rules, X-Sendfile and X-Accel-Redirect, and big files.

## How a download link works

A download link, such as `example.com/download/press-kit/` (or `example.com/?fileline=12` with plain permalinks), never shows where the file is. When it's followed, Fileline:

1. finds the download and the version asked for (the latest by default);
2. checks who may download it (members only, and any rules from Fileline Pro);
3. counts the download (see **Counting and privacy**);
4. sends the file, or redirects to an external file's address.

Files are sent with their type (`Content-Type`), size (`Content-Length`) and name (`Content-Disposition`, with the original name kept for modern browsers), in 1 MB chunks so big files don't use up the server's memory. Browsers and download managers can **resume** a download (range requests); the resumed parts aren't counted again.

Files are only ever sent from the uploads folder, so a link can never serve anything else from your server. PHP files, hidden files (such as `.env`), logs, database dumps and backups are never sent, and WooCommerce's product files (`uploads/woocommerce_uploads`) only to people who manage the shop.

## The protected folder

Files uploaded in a download's **Versions** box go into `wp-content/uploads/fileline/` (in year and month folders, like the rest of your uploads). The folder holds:

- an `.htaccess` file that refuses every direct request on **Apache** and **LiteSpeed**, except the thumbnails WordPress makes (in the size set under **Settings → Media**), so they still show in the Media Library;
- a `web.config` file that refuses every direct request on **IIS**;
- an `index.php` file, so the folder can't be listed.

Images and PDFs uploaded there get only a thumbnail, no medium or large copies, so no near full-size copy is public. An image whose name looks like a thumbnail (`logo-150x150.png`) is saved as `logo-150x150-file.png`, so it can't pass for one.

If WordPress can't write these files (the uploads folder isn't writable), uploads go to the usual uploads folder instead, and the Versions box doesn't mark them protected.

Under **Downloads → Settings → Protected folder**, click **Check the protection**: Fileline puts a test file in the folder and tries to open it by its address, then tells you whether that was refused. If the test file can't be written, the check says it couldn't run.

### nginx

nginx doesn't read `.htaccess` files. Add the rule shown on the settings screen to your site's `server` block, for example:

```nginx
location ^~ /wp-content/uploads/fileline/ {
	location ~* "-(150x150)\.(jpe?g|png|gif|webp|avif)$" {
		allow all;
	}
	deny all;
}
```

The `150x150` part is your thumbnail size; the settings screen shows the rule with yours. On managed hosting, send this to your host's support. Then run the check again.

### IIS

The folder's `web.config` uses IIS's Request Filtering, which IIS includes and lets folders set by default, to refuse every request for a file in the folder. It can't tell thumbnails apart, so on IIS the protected files show no preview in the Media Library. If the check says the files can be opened, ask your host to make sure Request Filtering is installed and may be set in `web.config` files.

> [!NOTE]
> Files picked from the rest of the Media Library are served through Fileline's links too, but they're still reachable at their own address. To protect a file, upload it in the Versions box.

## Sending big files faster

By default PHP sends the file, which works everywhere. If your server supports it, let the web server do it after Fileline has checked and counted the download:

| Setting | Server | What to set up |
|---|---|---|
| **X-Sendfile** | Apache with `mod_xsendfile`, LiteSpeed, Lighttpd | Apache: install `mod_xsendfile` and allow the uploads folder (`XSendFilePath /path/to/wp-content/uploads`). LiteSpeed supports it natively. |
| **X-Accel-Redirect** | nginx | An internal location that points at the uploads folder. The settings screen shows it with your paths, for example `location /fileline-protected/ { internal; alias /var/www/html/wp-content/uploads/; }` |

Choose it under **Downloads → Settings → Send files with**. If downloads come out empty after switching, the server doesn't support the method: switch back to PHP.

## Opening files in the browser

Tick **Open PDFs, images, audio and video in the browser** to have those shown in the browser instead of saved. Other files are always saved.

## External files

A version with a file address redirects the visitor there after counting. The address is visible to the visitor once they're redirected, so use this for files that may be public anyway (a CDN, a public release).

Source: https://extendiment.com/plugins/fileline/docs/1.x/secure-serving-and-server-setup