Harden your site security with Login Security, Two-Factor Authentication (2FA), Vulnerability Scanner, Firewall, and more. Formerly iThemes Security.
- Installs
- 700,000+
- Rating
- 4.6 (4K)
- Updated
- 17 days ago
Protect Uploads
Protect your uploads directory. Prevent browsing, password-protect files, add watermarks, and discourage right-click copying.
- Active installs
- 30,000+
- #911 of 1,000
- Downloads, all time
- 1.6M
- 1,618,336
- Downloads, 30 days
- 68.6K
- 9.1K in the last 7
- Rating
- 4.8 / 5
- 12 reviews
- Last updated
- 24 days ago
- Oct 7, 2026
- Version
- 0.8.0
- 11 releases
Upkeep and compatibility
| Last updated | October 7, 2026Updated in the last 3 months |
|---|---|
| Tested up to | WordPress 7.1.4Covers WordPress 7.1.4, the current release |
| Needs WordPress | 5.0 or newer |
| Needs PHP | 7.4 or newer |
| First published | March 31, 2015 |
| Support, last two months | 0 of 1 threads resolved (0%) |
Reviews
4.8 / 5 from 12 reviews
| 5 stars | 11 |
|---|---|
| 4 stars | 0 |
| 3 stars | 1 |
| 2 stars | 0 |
| 1 star | 0 |
Downloads, last 30 days
What the author says it does
The uploads directory is where the files of the WordPress media library are stored. Unfortunately, this directory is not protected by default: anyone who wants to see your whole library may be able to list it by going to http://yourwebsite/wp-content/uploads. This plugin hides the contents by adding an index.php file to your uploads directory and its subfolders, or by adding an .htaccess file that returns a 403 error (Forbidden Access).
- Depending on your server, the .htaccess option may be unavailable (Nginx does not read .htaccess files).
For more information, visit protectuploads.com.
Features:
- Directory Protection: Stop visitors from browsing your uploads directory (index.php or .htaccess 403). New year and month folders are protected as files are uploaded to them.
- Password Protection: Secure individual media files with passwords. Multiple passwords can be set for each file with custom labels. On Apache and LiteSpeed, the file’s direct URL also asks for the password, and repeated wrong guesses are rate limited.
- Image Watermarking: Add text watermarks to your uploaded images with customizable position, opacity, and font size. An untouched copy of each original is kept.
- Right-Click Protection: Discourages casual copying: disables the right-click menu and dragging on images. Determined visitors can still save images.
The opening of the plugin's own description. The full text, installation notes and changelog are on its WordPress.org page.
Questions the author answers
How do I add a password to a media file?
- Enable password protection in Media → Protect Uploads, on the Image Protection tab
- Open any media file’s edit screen (Media → Library, select the file, then “Edit more details”)
- Find the “Password Protection” box in the sidebar
- Add one or more passwords with descriptive labels
How does watermarking work?
When enabled, watermarking automatically adds text to images when they are uploaded. You can customize:
– The watermark text (defaults to your site name)
– Position (top-left, top-right, bottom-left, bottom-right, center)
– Opacity (0-100%)
– Font size (small, medium, large)
The watermark is applied to new uploads only. Animated GIFs are left unchanged.
Does watermarking change my original images?
Yes: the watermark is drawn on the uploaded file itself, so every size WordPress generates from it carries the mark. Before drawing it, the plugin keeps an untouched copy of the original in wp-content/uploads/protect-uploads-originals/, in the same year/month folders. That folder is blocked from web access on Apache and LiteSpeed; on Nginx each copy has a random name so its URL cannot be guessed.
Can I password protect only certain file types?
You choose files one by one: any media file, including PDFs, images, videos and documents, can have its own passwords.
Does a password protect the file’s direct URL?
On Apache and LiteSpeed, yes: the plugin adds rules to the uploads .htaccess file that send the file’s direct URL to the password prompt. Nginx does not read .htaccess files, so there the password protects the links WordPress shows but the file itself stays reachable at its uploads URL.
Does this work on Nginx?
Partly. The index.php method, watermarking, right-click protection and the password prompt work on any server. Nginx does not read .htaccess files, so the .htaccess method is not available and a password-protected file can still be downloaded at its direct uploads URL by anyone who knows it. To block directory listing on Nginx, also make sure “autoindex” is off for your uploads directory.
Latest changelog entry
Security
- Fixed: a password-protected file stayed downloadable at its direct uploads URL. On Apache and LiteSpeed, direct requests for the file, its image sizes and its WebP/AVIF copies now go to the password prompt
- Fixed: failed passwords were logged but never limited; 5 failed attempts per visitor per file now lock that visitor out for 15 minutes
- Fixed: simultaneous password guesses cannot exceed the attempt limit; successful passwords refund only their own attempt
Screenshots
The Directory Protection tab, with the protection status of each uploads folder. 
The Password Protection box on a media file's edit screen. 
The Image Protection tab: password protection, watermark and right-click options.
Tagged
Plugins that share its tags
Firewall, Malware Scanner, Two Factor Auth, and Comprehensive Security Features, powered by our 24-hour team. Make security a priority with Wordfence.
- Installs
- 5+ million
- Rating
- 4.7 (5K)
- Updated
- 31 days ago
#17 by installs
Jetpack – AI Agents & MCP, Security, Backup & Analytics
Connect ChatGPT, Claude, or another AI agent to your site. Plus backup, malware scan, firewall, stats, CDN, and SEO tools in one plugin.
- Installs
- 3+ million
- Rating
- 3.7 (2.4K)
- Updated
- 4 days ago
Easily improve site security with WordPress Hardening, Two-Factor Authentication (2FA), Login Protection, Vulnerability Detection and SSL certificate.
- Installs
- 3+ million
- Rating
- 4.9 (8.9K)
- Updated
- 5 days ago
#20 by installs
Hostinger Tools
Simplified WordPress management. Manage site info, maintenance, security, & redirects.
- Installs
- 3+ million
- Rating
- 3.5 (40)
- Updated
- 10 days ago
WordPress login security with brute force protection, Two-factor authentication (2FA/MFA), firewall, IP/country blocking, and login monitoring
- Installs
- 1+ million
- Rating
- 4.8 (1.5K)
- Updated
- 38 days ago
Where this page's numbers come from
Read from the WordPress.org plugin API on , when WordPress 7.1.4 was the current release. WordPress.org rounds active installs into buckets. These are the directory's figures, not my verdict, and I haven't tested this plugin.