Secure File Downloads
Hand out PDFs without burning the direct /wp-content/ URL.
→ the free version is fully usable on its own. Pro is an optional upgrade, not a paywall.
Then $7/mo after your 14-day trial · cancel anytime in one click.
You want to give visitors a PDF, a brochure, a price sheet — but you don't want to leak the raw /wp-content/uploads/ URL into your HTML where it gets scraped, hot-linked, and shared past your control. Secure File Downloads picks the file from your Media Library, hides the real URL behind a stable File ID, and serves the download through a nonce-protected endpoint with a clean shortcode button. No file manager bloat, no membership plugin, no fake feature ladder. Pro adds per-file password gates, download limits with counters, and a download analytics dashboard — so you actually know who pulled what.
If any of these sound like you
Newsletter and lead-magnet bloggers
You wrote a 30-page guide, captured an email, and now you need to deliver the PDF. You don't want that PDF URL hot-linked across Reddit by tomorrow. One shortcode, one nonce-protected endpoint, one File ID — done.
Small businesses distributing price sheets and brochures
Sales sends customers a download link. Pro adds a per-file password and a counter, so when the same PDF gets passed to a thousand people, you see it and you can change the password without rewriting any links.
Agencies and freelancers wiring up client sites
Client wants secure downloads — but a full file manager plugin is overkill and a membership plugin is six weeks of setup. Drop this in, paste the shortcode in five posts, done before lunch.
Course creators and membership-lite sites
You're gating downloadable resources but you're not running a full LMS. Password each file, set a download cap per file, and watch the analytics tell you which resources actually get pulled.
What's in the box
Everything in the free column works on its own — install it and you're done. The pro column is an optional upgrade for power users; you never need it to use the plugin.
Free version
no purchase required · fully usable
- Media Library file pickerPick any file already in your Media Library and assign it a stable File ID.
- Shortcode download buttons[bbasfd_download id="FILE_ID"] places a download button anywhere — pages, posts, widgets, page builders.
- Nonce-protected endpointDownloads stream through a controlled endpoint that validates a nonce before serving the file.
- Hidden direct URLsThe actual /wp-content/uploads/ path is never rendered in your HTML.
- Customizable button text & classtext="Get the PDF" and class="my-css-class" attributes for styling and copy.
- Unlimited secure filesNo cap on the number of secure File IDs you can create on the free tier.
- WP_Filesystem-based readsPlugin Check compliant — no raw fopen, no direct $_GET access.
- Works with any page builderElementor, Gutenberg, classic editor — anywhere shortcodes render.
Pro adds (optional)
an upgrade, not a gate
- Unlimited files (license-flag override)Pro hooks bbasfd_max_files at priority 99 and forces it to 0 (unlimited). Free defaults to 0 already as of 1.0.7, but Pro keeps the explicit override so cap restoration in a future free release wouldn't affect pro users. Confirmed at pro/bba-secure-file-downloads-pro.php line 79-81.
- Per-file download limitsSet a maximum download count per file (0 = unlimited). When the counter hits the cap, downloads of that file return forbidden. Includes a 'Download Limits (Pro)' admin sub-page showing current count + remaining for each file, plus a reset-counter form. Implemented in pro/includes/pro-core.php as of pro v1.1.0 (shipped 2026-05-16). Counter is stored in the existing BBASFD_OPT_FILES option (extends each file entry with 'limit' and 'downloads' keys).
- Download analyticsPer-download event log + admin dashboard. Logs each successful download (timestamp, file_id, attachment_id, user_id, anonymized IP /24, user agent). 7/30/90-day window selector, 4 summary cards, daily inline-SVG bar chart, top files + recent events tables. New DB table bbasfd_download_events. Implemented in pro/includes/class-download-analytics.php as of pro v1.2.0 (shipped 2026-05-17).
- Password-protected downloadsPer-file password gate that runs before the download is served. Correct password issues a 30-minute httponly HMAC-signed cookie so the same browser isn't re-prompted within the TTL. Challenge page is self-contained (inline styles, no theme dependency) and shows an error banner on wrong-password retry. Admin sub-page 'File Passwords' lets the operator set/clear passwords per file. Implemented in pro/includes/class-password-protection.php as of pro v1.2.0 (shipped 2026-05-17).
Screenshots
No lite-version tricks
- ✓Unlimited secure files
- ✓Shortcode buttons
- ✓Nonce-protected endpoint
- ✓Direct URL hiding
- ✓Everything in Free
- ✓Download analytics — who, when, how many
- ✓Password-protected downloads
- ✓Per-file download limits
- ✓Email support
- ✓Everything in 1 Site
- ✓Use on up to 5 sites
- ✓Priority email support
- ✓Everything in 5 Sites
- ✓Unlimited site activations
- ✓Priority email support
Common questions
How does the secure download endpoint actually work? +
Why does the free version limit me to 3 files? +
Do I need WooCommerce? +
Does it work with Elementor and Gutenberg? +
Can I customize the button text and styling? +
Does it hide my Media Library URL completely? +
Is it Plugin Check / WordPress.org compliant? +
Will my downloads work behind a CDN or caching plugin? +
What does Pro add? +
Where do I get support? +
GET PRO.
FREE FOR 14 DAYS.
Unlock every Pro feature of Secure File Downloads right now. Add your card, use it free for 14 days, and cancel anytime in one click before day 14 — pay nothing.