Greetings,
Several eMember users whose sites include links to content such as mp3s, pdfs, videos, etc. have asked if there is a way to password-protect the folders in which these files reside. The concern is that while eMember restricts access to the subscriber-only pages containing the links, the folder containing the content is open, and a subscriber to your site can simply share the download link itself with someone else.
Good news: There is a way to protect the folder containing your content, while also using eMember to manage subscriptions to your site.
The solution can be found here:
http://www.tanzilo.com/2008/10/18/password-protect-sub-directory-in-wordpress-by-htaccess/
And I will describe how I implemented it on my site. I have not delved into all the possible tweaks. I have simply put together a solution that makes sense and works - for me. Others may want to tinker further.
Step 1: I created the directory (folder) "download" for my protected content, using cPanel:
http://www.my_website.com/public_html/wordpress/download
and I uploaded an mp3 into this directory.
(I have deviated slightly from the directions found at tanzilo.com, by putting my content folder not in my site's root directory, but inside my /wordpress directory. This was to avoid some potential conflicts with pretty links.)
Step 2: As directed by tanzilo.com, I edited the file http://www.my_website.com/public_html/wordpress/(dot)htaccess from this:
# BEGIN WordPress
<IfModule mod_rewrite.c>
RewriteEngine On
RewriteBase /wordpress/
RewriteRule ^index\.php$ - [L]
RewriteCond %{REQUEST_FILENAME} !-f
RewriteCond %{REQUEST_FILENAME} !-d
RewriteRule . /wordpress/index.php [L]
</IfModule>
# END WordPress
to this:
# To bypass download directory
ErrorDocument 401 /%{REQUEST_URI}/myerror.html
ErrorDocument 403 /%{REQUEST_URI}/myerror.html
# BEGIN WordPress
<IfModule mod_rewrite.c>
RewriteEngine On
RewriteBase /wordpress/
RewriteRule ^index\.php$ - [L]
RewriteCond %{REQUEST_FILENAME} !-f
RewriteCond %{REQUEST_FILENAME} !-d
RewriteRule . /wordpress/index.php [L]
</IfModule>
# END WordPress
Step 3: Using cPanel, I password-protected the directory http://www.my_website.com/public_html/wordpress/download. At this point, every time you add a subscriber with a User Name and Password to eMember who needs access to this directory - in my case, to access the mp3 - you must also add this User Name and Password in cPanel to the directory http://www.my_website.com/public_html/wordpress/download.
That's pretty much it. Now no outsider can enter this into their browser:
http://my_website.com/wordpress/download/my_audio_file.mp
and get the mp3 - because now cPanel requires a User Name and Password for the download folder.
Now, just a little extra detail:
In my case, my subscriber, who is paying for access to the mp3 in my http://www.my_website.com/public_html/wordpress/download directory, sees two things on her content page: the Audio Player button, and a download link below it. If I make them both link to the mp3 in http://www.my_website.com/public_html/wordpress/download thusly:
Audio player link: [audio:http://my_website.com/wordpress/download/my_audio_file.mp3]
and
Download link: href="http://my_website.com/wordpress/download/my_audio_file.mp3"
then clicking on either link will trigger cPanel to ask for a User Name and Password for the http://www.my_website.com/public_html/wordpress/download directory. Since the Audio Player button does not reveal the download link to the mp3, I would prefer that clicking on it would play the mp3 without requiring a cPanel User Name and Password, to save my subscribers the bother, whilst clicking on the download link would require a User Name and Password.
To accomplish this, I simply create a second unprotected folder (download_2) to hold a duplicate copy of the mp3, and link the Audio Player to this mp3, and link the download link to the mp3 inside the cPanel protected folder, thusly:
Audio player link: [audio:http://my_website.com/wordpress/download_2/my_audio_file.mp3]
and
Download link: href="http://my_website.com/wordpress/download/my_audio_file.mp3"
This works for me. If I go to a second computer, and enter in the browser http://my_website.com/wordpress/download/my_audio_file.mp3, it asks for the cPanel User Name and Password.
Cheers, and Good Luck!
