I have a script that allows only authorised users to upload files to a certain folder.

However I do not know how to prevent people from downloading freely without login.

I need the solution in php.

I have googled around but nothing straight forward as yet.

Currently in my document root I have a folder called admin and a subfolder called uploads inside the admin. So only admin role can upload. Both editor and admin can download. What should I do in this case?

Please advise.


Put the files somewhere outside the public webroot directory, or configure your server to not serve the files. As long as your server will happily serve everything with a valid URL, there's nothing you can do with PHP to prevent that.

If your files are in the /public_html/ folder, take them out of that folder and place them in e.g. /secret_files/, so your directory structure looks something like this:


The webserver is only configured to serve files in the /public_html/ directory, so nobody will have access to directories outside (technical term above) it.

To still enable somebody to download those files, do as cletus suggests and use readfile to "manually serve" the files via a PHP script. PHP will still have access to these other parts of the file system, so you can use it as a gatekeeper.


Don't store the files in a directory under the document root.

Instead move them somewhere else and then a PHP script can programmatically determine if someone can download them and then use readfile() or something similar to stream them to the user.

You could also configure the Web server to not serve files from this directory but then you need PHP to serve them anyway. It's cleaner simply not to put them under the document root.

  • hi cletus, i am not strong in programming so I need to ask you for more specifics 1) where is somewhere else? currently in my document root i have a folder called admin and a subfolder called uploads inside the admin. so only admin role can upload . both editor and admin can download. what should i do in this case? – Kim Stacks Feb 26 '10 at 5:34
  • 1
    @keisimone (1) Store them above the document root, which may be somethign like htdocs or public_html. – alex Feb 26 '10 at 5:38
  • @alex yes all my files are already in public_html :) so its public_html > admin > uploads – Kim Stacks Feb 26 '10 at 5:57
  • 1
    @keisimone can you move them above your docroot. So accessing them from your public_html would like like this '../downloads/file.txt' – alex Feb 26 '10 at 6:08
  • 1
    @keisimone Yes, or higher. You should not be able to go to www.yoursite.com/downloads by default. – alex Feb 26 '10 at 6:49

Answering question on how to password protect with PHP: This should solve your problem.

  • and what about someone find the password ? – RageZ Feb 26 '10 at 5:24
  • 4
    If they find the password, most likely they have access to your FTP so you are screwed anyways. – twodayslate Feb 26 '10 at 5:25

Your Answer

