S2member-files not protected after server migration

#1

Hi,

I have migrated the website to an other server (clone, same domain). Everything works fine except one important feature. The s2member-files folder is not protected no more… The files are now downloadable from the url by anybody.

Exemple URL:
https://domaine.net/wp-content/plugins/s2member-files/myPDF.pdf

What can I do to secure this folder please ?

Regards

#2

It sounds like you need to regenerate your .htaccess file.

#3

I thought about something like that… but how to please ?
And do I have to regenerate only the one from the s2member-files folder or the htaccess of the root website too ?

Many thanks Kim for that quick answer !

#4

Try this. Deactivate s2Member, and then delete the .htaccess file in the s2member-files folder. Then reactivate s2Member.

#5

Did it. The htaccess is well generated but I still can download files from direct url without being connected.

#6

Are you sure that you are trying this as a logged-out user, or one with insufficient permissions?

#7

I’m trying from another browser, private navigation, not connected with any user.

Thank you again

#8

Are you on GoDaddy hosting?

#9

WPSERVEUR, a Wordpress Host.

#10

Then I’d talk to them.

#11

The issue come from the nginx server. The host tried to follow the explanations from this page to secure the s2member-files folder:

But it retruns a 403 error even for connected users…

#12

How do you have nginx with a .htaccess file?

#13

@eds, try to save your permalinks again. Not sure it will helps, tough…

#14

The permalinks are ok, thank you krumch.
I finally migrate the website to a VPS on apache (plesk). And now I have another issue… the downloads are ok and protected again. But I have html files into the s2member-files folder which I load on some pages into iframe. Now this content only displays if I disable the htaccess file. If the htaccess is enabled I have strange code instead of the html content:

html-with-htaccess-enabled.png826×592 127 KB

Any idea again ? Best regards

#15

That is UTF code, I think. That is because s2M sends HTML files like binary files, and browser don’t recognize them as “page”, but as “text with binary coded symbols”. Is they downloads right before to move? Try to exclude HTML files from download protection, maybe…

#16

Like this ?

inline-html.png945×471 110 KB

#17

Problem solved enabling this option:

force-content-encoding.png943×231 60.5 KB

Is it safe to keep this on ?

#18

Great! I was forgot that setting…

Yes, it is safe, it works for “download files” only.

#19

Ok, many thanks guys !