I have a scenario that I want to let people that visit my WordPress website download some PDFs. These PDFs go to my website as products of the Woocommerce plugin, so they are stored on the folder uploads/woocommerce_uploads. At the moment, I don't want people to go through all the process of buying a free product. If the user is already logged in, and has the necessary privileges, I show a custom download button, which points directly to the PDF's path in the uploads folder. Something like this:


Does this direct link to a PDF files as a way to let people download them open any vulnerability or harm in any way my WordPress website?

  • 1
    By just downloading a file I see not any security issue other than bypassing authentication. With this I mean that if someone shares this direct link with users that do not have an account on your site, they will (most likely) be able to download PDF files. This could lead to some extra website traffic. – Jeroen Sep 25 at 12:45
  • Oh I see. Ok. Thanks! – churros Sep 25 at 13:21
  • 2
    Remember that if you don't check if a user is logged in before allowing them to download the PDF, anyone will be able to download it, including search engines. What I mean is that your PDF in theory might end up getting indexed, and be found on search engines. – reed Sep 25 at 13:32
  • Ok.. Understood! – churros Sep 25 at 14:42

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.