How Protected Media Files Work

LifterLMS includes a built-in media protection system that restricts access to files, including videos, audio, documents, and images. When enabled, only logged-in users with the correct course or membership access can view or download protected files.

This guide explains how media protection works, how to enable it, and which files are automatically secured.

By default, WordPress stores uploaded files in a public directory. Anyone with a direct URL can access those files, even if they are not enrolled in a course.

When you enable Content Protection in LifterLMS:

• Files are moved to a private directory on your server.
• Direct public access is blocked.
• LifterLMS verifies permissions before any file is delivered.

LifterLMS serves protected files through a secure PHP handler rather than a direct URL. This ensures files cannot be accessed or shared publicly.

The process is:

1. Obfuscated URL

• Media is delivered through a protected link instead of /wp-content/uploads/….
• The real file path is hidden.

2. Permission Check

• When a user opens a protected file, LifterLMS checks whether:
  • they are logged in
  • they are enrolled in a course or membership that grants access

3. Secure Delivery

• If the user passes the permission check, the file is served.
• If not, access is denied.

This process is automatic and transparent to authorized users.

1. Go to LifterLMS > Settings > General.
2. Find “Content Protection”.
3. Check “Enable File Protection” (or equivalent, depending on your version).
4. Click Save Changes.

LifterLMS will create a private directory at:

/wp-content/uploads/lifterlms/

…and add an .htaccess file to block direct access (Apache only).

Media protection works automatically on Apache servers. NGINX servers require an additional rewrite rule.

Apache

No action required. Protection is configured automatically.

NGINX

You must add a rule to your server configuration. Without it, protected files may be publicly visible or return 404 errors.

Please give your host or server administrator the code snippet in the official documentation:

https://lifterlms.com/docs/protected-media-files-on-nginx/

LifterLMS protects some images automatically (especially those used in quizzes). Others can be protected manually from the Media Library.

5.1 Automatically Protected Images (Quizzes)

The following quiz-related images are always protected when Content Protection is enabled:

• Quiz Question Image Description

Images added to the Image Description field of a quiz question.

• Picture Choice Questions

All images used for Picture Choice question types.

• Reorder Pictures Questions

(Advanced Quizzes add-on) Images used in Reorder Pictures questions.

5.2 Manually Protecting Other Images

For any other image, including those used in lessons, course descriptions, or blog posts, you can manually mark the file as protected.

1. Open the Media Library.
2. Select the file.
3. In Attachment Details, find the Protection dropdown.
4. Choose Protected File.

Only authorized students will be able to view this image.

5.3 Images That Are Not Protected by Default

These images must be protected manually if you want them to be restricted:

• Images added to the main quiz description
• Images placed in a question’s general description field (not the Image Description field)

Any image inserted directly into the text editor is publicly accessible unless manually protected.

If you have file protection enabled and are using LifterLMS Assignments 2.3.0 or newer, all student assignment uploads are protected automatically.

No additional configuration is required.

For a walkthrough of media protection features, watch:

What types of files can be protected?

Any file type supported by WordPress, including PDFs, MP4, MOV, MP3, JPG, PNG, DOCX, and PPTX.

Does this work with Amazon S3, Vimeo, or Wistia?

No. Media Protection only applies to files stored on your server. Use the privacy controls provided by your external storage or video provider.

Are assignment submissions protected?

Yes. With Content Protection enabled and Assignments 2.3.0+, all student submissions are protected.

Media Protection is available in the core LifterLMS plugin. Some quiz-related image protection features require the Advanced Quizzes add-on.