Recorded file owners
Logged-in owners and administrators can access their files. Guests do not gain permission to access files uploaded by other guests.
Ownership checksKeep files in protected storage, manage access from WordPress and display the right attachments to the right people—with or without a page builder.
WordPress.org directory listing pending approval. Download the plugin directly in the meantime.
Reusable shortcode configuration
Please log in to view your secure files.
A normal WordPress attachment URL is not an access-control system. Secure Document Storage separates the file people recognize from its protected storage location and checks access when the file is served.
Files are saved with obfuscated names. Configure a private filesystem path outside the public web root when your hosting supports it.
View and download requests use access checks and nonce-protected, streamed responses rather than exposing direct public file links.
The uploaded name remains available for authorized display and downloads, even though the stored filename is obfuscated.
Server configuration still matters: Apache/LiteSpeed must honor deny rules for protected uploads; Nginx requires matching server rules. Private storage outside the public web root is recommended.
Search, filter, review and manage secured attachments from WordPress. Administrators can manage the library; authorized non-admin roles can be restricted to all files or only their own.
The interactive workspace below demonstrates search, file-type filtering, pagination and access scopes. It contains fictional records—not files from a real WordPress installation.
Browse authorized documents and inspect file details.
| File | Owner | Source | Added | Access | Actions |
|---|
Document permissions can follow attachment ownership, designated roles or JetFormBuilder source forms. Backend library permissions are managed separately from frontend file access.
Logged-in owners and administrators can access their files. Guests do not gain permission to access files uploaded by other guests.
Ownership checksGrant selected roles broader file access globally, or restrict additional access to documents associated with a specific JetFormBuilder form.
Configurable rolesAuthorized staff can receive a files-only admin menu, with all-files and own-files library capabilities assigned independently.
Scoped managementYou can use native uploads and shortcodes without JetFormBuilder, JetEngine or Elementor. Each integration adds features when its parent plugin is installed.
Native secure-file uploads, attachment records, backend library, ownership-aware access and shortcodes.
No builder requiredRoute selected forms through secure storage, apply form-level role grants and display processing feedback.
Optional integrationUse the Secure File Links callback and render media fields or repeater files in dynamic listings, including CCT contexts.
Optional integrationUse existing styling controls and place secure shortcodes in builder layouts, including template-driven file displays.
Optional integrationExample settings overview. Not connected to WordPress.
Permissions, storage configuration and shortcode presets are available through WordPress administration. Separate the tasks your file managers need from the settings only administrators should change.
Keep the file workflow inside WordPress and let the page context determine what authorized visitors see.
Add a secure file directly from WordPress or use a selected JetFormBuilder form. The storage service records file metadata and uses a protected location.
Use recorded ownership, administrator access and configured roles. Keep frontend file permissions independent of backend library scope.
Place a single-file or repeater shortcode in your layout. The plugin resolves the current object and shows authorized file actions.
The plugin is designed around WordPress-local storage and permission checks. It does not automatically harden your server configuration, move old documents into a new path or replace a full document-sharing platform.
Cloud storage, file versioning, public upload forms and encryption are not part of this release. Keeping this distinction clear matters when handling sensitive information.
Ask a technical question* Proper deny rules must be configured on your server. Nginx does not process .htaccess. Verify file isolation before using the plugin for sensitive records.
No. Native secure uploads, the backend library and shortcodes work without JetFormBuilder, JetEngine or Elementor. Those plugins are optional integrations.
Yes, when you provide the actual field name. The default auto context resolves the current JetEngine listing object first, then a WordPress loop post or queried user. You can also specify a post, user or current-user context.
Yes. Backend library access can be assigned by role, with all-files or own-files capabilities. Plugin settings remain administrator-only. Uploading and deleting also follow the relevant WordPress permissions.
No. New files use the configured path; existing secured files remain at their recorded locations. Keep earlier storage locations available until they are no longer needed.
No. Filesystem and web-server configuration must be verified. Apache/LiteSpeed must honor the generated deny rules, while Nginx needs equivalent server configuration. A private directory outside the public web root is preferable.
These pages should be excluded from shared full-page caching. The plugin requests private no-cache behaviour, but an upstream cache can respond before WordPress executes.
Manage protected files natively, connect dynamic WordPress content and control who sees each document. Free to download now; WordPress.org listing pending.
This is a fictional document used to demonstrate the interface.