Private uploads

WPReturns stores customer photos, videos, message files and return labels in a private folder outside the media library. Files get random names and are only served to the customer, a holder of the secret request link or your team. Apache blocks the folder by itself, and nginx needs one rule.

Available in: Free and Pro.

Where files are stored

wp-content/uploads/ddwcwr-private-{hash}/YYYY/MM/{random}.{ext}

{hash} is 16 characters derived from your site’s salts. It differs on every site and cannot be guessed. The folder holds an .htaccess file and an empty index.php.

Uploads are checked before they are stored:

• The file type must be on the Allowed file types list in your settings.
• The real MIME type must match the extension.
• Each file must stay under the size limit. The number of files must stay under the file limit.
• PHP, SVG, HTML and JavaScript files are always refused whatever the settings say.

How files are served

Every file link goes through wp-admin/admin-post.php?action=ddwcwr_file. WPReturns checks access before it sends a byte.

Visitor	Gets the file when
Staff	The user can manage requests
Logged-in customer	The request belongs to them
Guest	The link carries the request’s secret key
Anyone else	Never. They get “You are not allowed to view this file.” (403)

Attachments on internal notes are served to staff only.

Apache and LiteSpeed

WPReturns writes this .htaccess file into the folder on first use:

Require all denied
Deny from all

Direct links to the folder then return 403. Nothing else is needed.

nginx

nginx ignores .htaccess. Add this rule to your site’s server block and reload nginx:

location ~ /ddwcwr-private- {
    deny all;
}

sudo nginx -t && sudo systemctl reload nginx

Without the rule, files are only protected by their random names. Managed hosts that run nginx can add the rule for you. Send them the snippet above.

Tip

Test it. Open https://example.com/wp-content/uploads/ followed by the folder name in a private window. A 403 or 404 means the rule works.

Move the folder outside the web root

The safest setup keeps the files where the web server cannot reach them. Use the ddwcwr_private_upload_dir filter to point WPReturns at a folder outside the public directory.

<?php
/**
 * Plugin Name: WPReturns private folder
 */
add_filter( 'ddwcwr_private_upload_dir', 'myshop_ddwcwr_private_dir' );

function myshop_ddwcwr_private_dir( $dir ) {
  // One level above the WordPress folder, outside the web root.
  return dirname( ABSPATH ) . '/ddwcwr-private';
}

Save it as a must-use plugin in wp-content/mu-plugins/ so it loads before WPReturns. PHP needs write access to the new folder. WPReturns creates it if it is missing.

Caution

Changing the folder does not move existing files. Copy the contents of the old ddwcwr-private-{hash} folder to the new one before you switch. Links to older photos and labels break otherwise.

Backups and uninstall

Include the private folder in your backups. Request rows point to files by their stored key.

Deleting a request deletes its files, and the privacy eraser deletes the files of the person it erases.

With Delete all WPReturns data when the plugin is deleted turned on, uninstalling removes the ddwcwr-private-* folder in uploads. A folder you moved with the filter stays and needs deleting by hand. See Advanced settings.

Related

• Advanced settings
• Return policy settings for upload limits
• Hooks reference
• Troubleshooting