Protected Downloads & File Security

Selling digital products, course materials, or member-only resources requires secure file delivery. BricksMembers’ Protected Downloads system ensures only authorized members can access your files, with comprehensive security features and easy integration with Bricks Builder.

What you’ll learn:

• How protected downloads work (security architecture)
• Creating and managing protected downloads
• Adding download buttons to your pages
• Assigning downloads to posts and structures
• Displaying download lists with query loops
• Tracking download activity
• Best practices for file security
• Configuring cloud storage (S3, Bunny CDN, GCS)
• Troubleshooting common issues

Prerequisites:

• Bricks Builder installed and activated
• BricksMembers installed and activated
• Protected Downloads module enabled
• At least one user level created

Part 1: Understanding Protected Downloads

How It Works

Traditional WordPress file uploads are publicly accessible. Anyone with the URL can download the file, even if they’re not logged in.

Example of insecure file:

https://yoursite.com/wp-content/uploads/2025/01/premium-ebook.pdf

Anyone can access this URL directly.

BricksMembers Protected Downloads:

1. Files are stored through BricksMembers private storage. The preferred location is outside public uploads when the server allows it; uploads-based storage is fallback compatibility.
2. If storage falls back to a public web-accessible location, BricksMembers writes server-blocking files where possible. Direct access should still be tested on your host.
3. Files are served through PHP verification that checks user access
4. Nonce verification prevents unauthorized link sharing

Example of protected file:

https://yoursite.com/?brm_download=123&nonce=abc123def456

This URL includes nonce verification and only works for authorized users.

Security Features

1. Private Storage and Fallback Server Protection

• Uses the private storage resolver first, including BRM_PRIVATE_STORAGE_DIR, a sibling brm-private directory, or wp-content/brm-private where available
• Writes blocking files for public fallback storage where possible
• Prevents directory listing
• Forces all downloads through PHP

2. Access Verification

• Checks if user is logged in
• Verifies user has required levels
• Checks download post status (must be published)
• Validates nonce for security

3. File Type Restrictions

Allowed file types:

• Documents: PDF, DOC, DOCX, XLS, XLSX, PPT, PPTX, TXT, RTF, CSV
• Images: JPG, JPEG, PNG, GIF, WEBP
• Audio: MP3, WAV, OGG, M4A
• Video: MP4, AVI, MOV, WMV, FLV
• Archives: ZIP, RAR, 7Z, TAR, GZ

4. File Size Limit

• Maximum file size: Configurable (default: 100 MB)
• Set in BricksMembers → Protected Downloads → Download Settings
• Prevents server overload and abuse

5. Filename Sanitization

• Removes path traversal attempts (../, ./)
• Sanitizes special characters
• Generates unique filenames to prevent conflicts

The admin side is protected too: BricksMembers keeps the Protected Downloads screen under normal administrator access, but uses dedicated internal download capabilities behind the scenes so the downloads module does not interfere with WordPress core admin permissions or other plugins’ menu access.

Part 2: Enabling Protected Downloads

Step 1: Enable the Module

1. Go to BricksMembers → Modules
2. Find Protected Downloads
3. Toggle it ON
4. Confirm the change

Result: The Protected Downloads module is now active.

Step 1.5: Configure Download Settings (Optional)

Customize download behavior:

1. Go to BricksMembers → Protected Downloads
2. Scroll to the Download Settings card
3. Maximum File Size (MB): Set your preferred limit (default: 100 MB, max: 500 MB)
4. Enable Download Logs: Choose whether to track download activity in the database (enabled by default)
5. Assignable Post Types: Choose which post types can have protected downloads attached. The selected post types control where the Protected Downloads assignment field appears.
6. Access Denied Redirect URL: (Optional) Set where unauthorized users are redirected
7. Wait for the settings saved confirmation after changing a field

Tip: Be mindful of your server’s PHP upload limits. If you set a high max file size, you may also need to increase upload_max_filesize and post_max_size in your server’s PHP configuration.

Note: Changes in the Download Settings card save automatically when you change a field. Refresh the page after saving if you want to confirm the Assignable Post Types checkboxes are stored.

Step 1.6: Configure Cloud Storage (Optional)

To use files from cloud storage (Amazon S3, Bunny CDN, or Google Cloud Storage) instead of local uploads:

1. Go to BricksMembers → Protected Downloads
2. Open the Storage Provider card
3. Select your provider (e.g. Bunny CDN) from the dropdown
4. Enter credentials: Storage Zone Name, Storage Zone Password (from Bunny FTP & API Access—not your Account API key), Region, CDN Hostname, Token Authentication Key
5. For Bunny: set Token Authentication Type to match your pull zone (Advanced/SHA256 or Basic/MD5)
6. Click Test Connection, then Save Provider Settings

When creating a download, choose Remote Storage and use Browse Remote Files to select files from your cloud.

Step 2: Verify Directory Protection

The protected directory is created automatically, but let’s verify:

1. Check the configured private storage path in your environment first
2. If your install falls back to uploads compatibility, navigate to the fallback downloads directory
3. You should see the BricksMembers downloads storage directory
4. For Apache/public fallback storage, there should be a blocking .htaccess file

Contents of .htaccess:

# BricksMembers Protected Downloads
Options -Indexes
deny from all

If the directory doesn’t exist: Upload a file (next section) and it will be created automatically.

Part 3: Creating Protected Downloads

Create protected downloads using the admin interface:

Creating a Download

1. Go to BricksMembers → Protected Downloads
2. Click Add New Download
3. Fill in the details:
   • Title: “Premium Course Workbook”
   • Description: “A comprehensive workbook for the premium course.”
   • File: Click Choose File and select your PDF/ZIP/etc.
   • Download Image: (Optional) Choose an image
   • Required User Levels: Check “Premium Member”
4. Click Create Download

Result: The file is uploaded to the protected directory and a download post is created.

Tip: For large files that might timeout during browser uploads, you may need to increase your server’s PHP upload limits (see troubleshooting section below).

Understanding Download Metadata

Each download stores:

• Title: Display name
• Description: Optional description
• File Path: Relative path in /brm-protected/
• File Name: Original filename
• File Size: Automatically calculated
• Download Key: Unique 32-character key for secure URLs
• Required Levels: User levels needed to access
• Download Image: Optional thumbnail

Part 4: Adding Download Buttons to Pages

Now let’s add download buttons to your pages using Bricks Builder.

Method 1: Single Download Button

Use case: Add a download button to a lesson page.

Steps:

1. Edit your page/template with Bricks
2. Add a BRM Protected Download element
3. Configure:
   • Display Mode: Single
   • Download: Select the download from the dropdown
   • Button/Link Text: “Download Workbook”
   • Show Download Image: Yes (optional)
   • Show Filename: Yes
   • Show File Size: Yes
   • Layout Style: Horizontal (image on left, content on right)
4. Style the element as needed

Result: A download button that only works for users with the required levels.

Method 2: Dynamic Download (Current Post)

Use case: Create a “brm_download” post type template where the download is the current post.

Steps:

1. Go to Bricks → Templates
2. Create a new Single template
3. Bricks conditions: Post Type → brm_download
4. Add a BRM Protected Download element
5. Display Mode: Single
6. Download: Leave empty (uses current post)
7. Add other elements as needed (heading with {post_title}, text with {post_content}, etc.)

Result: A template for all download pages.

Method 3: Download List

Use case: Show all available downloads on a “Resources” page.

Steps:

1. Create a new page: “Member Resources”
2. Edit with Bricks
3. Add a BRM Protected Download element
4. Configure:
   • Display Mode: List
   • Number of Downloads: 10
   • Filter by User Level: Yes (only show downloads the user can access)
   • Show Download Image: Yes
   • Show Filename: Yes
   • Show File Size: Yes
5. Style the element as needed

Result: A list of all downloads the user has access to.

Method 4: Downloads Assigned to a Structure

Since version 1.1.12: You can assign existing protected downloads to a whole content structure, not only to individual posts. This is useful for course-wide resource packs, onboarding files, shared worksheets, or bonus downloads that belong to the structure itself.

1. Open BricksMembers → Content & Structures and manage the structure you want to edit
2. In the structure header, click Downloads
3. Search for existing protected downloads and select the files that belong to this structure
4. Click Save

To display those files, use the Protected Download element with Download Source set to Downloads assigned to current structure, or create a native Bricks Posts query loop with post type brm_download and Assigned Downloads set to Only Downloads Assigned to Current Structure.

Part 5: Advanced Download Displays

Using Query Loops for Custom Layouts

For complete control over the layout, use a query loop instead of the BRM Protected Download element.

Steps:

1. Add a Div element
2. Enable Use query loop
3. Configure query:
   • Query type: Posts
   • Post type: Protected Download
   • Posts per page: 10
   • Order by: Title
   • Order: ASC
4. Scroll to BricksMembers Query Filters:
   • User Level Match: Match (only show accessible downloads)
5. Inside the loop, add:
   • Image element: Source → {brm_download:image}
   • Heading (H3): {post_title}
   • Text: {post_content}
   • Text: “File size: {brm_download:size}”
   • Text: “File type: {brm_download:file_type}”
   • Button: “Download” → Link: {brm_download:url}

Result: A fully customized download grid.

Conditional Download Access

Show different content based on whether the user has access.

Steps:

1. Add a Container
2. Add a BRM Protected Download element or a Query Loop like above inside
3. Add another Container (outside the first)
4. Inside the second container, add a Text element: “Upgrade to Premium to access this download”
5. Add a Button: “Upgrade Now”
6. Go to Conditions tab on the second container
7. Add condition: BricksMembers → User level match → is → No
8. Do the same for the first container with BricksMembers → User level match → is → Yes

Result: Users with access see the download button. Users without access see an upgrade message.

Part 6: Download Tracking

BricksMembers can track download counts and log download activity for each protected file.

Viewing Download Statistics

1. Go to BricksMembers → Protected Downloads
2. Each download shows a Downloads column with the total download count

What’s tracked:

• Total Downloads: How many times the file has been downloaded (stored in post meta _brm_download_count)
• Download logs (Optional): If enabled in settings, each download is logged to the brm_download_logs database table with user ID, download ID, timestamp, IP address, and user agent

Enable/Disable Logging:

1. Go to BricksMembers → Protected Downloads
2. Scroll to Download Settings
3. Toggle Enable Download Logs on or off
4. Wait for the settings saved confirmation

Note: The total download count is always tracked. The optional logging adds detailed records (user, IP, timestamp) for compliance or analytics. Disable it if you don’t need this data or want to reduce database usage.

Use cases:

• Identify popular resources
• Measure content engagement
• Justify content creation efforts

Part 7: Best Practices

Practice 1: Use Descriptive Filenames

Bad: file1.pdf, document.zip

Good: wordpress-beginners-workbook.pdf, premium-course-templates.zip

Why: Users know what they’re downloading, and it’s easier to manage.

Practice 2: Compress Large Files

Before uploading:

• Compress files to zips to save space
• ZIP multiple files together
• Optimize images before including in PDFs

Benefits:

• Faster downloads for users
• Less server bandwidth usage
• Stays under your configured file size limit

Practice 3: Add Thumbnails

Always add a download image:

• Makes the download list more visually appealing
• Helps users identify content quickly
• Increases perceived value

Practice 4: Test Download Links

After creating a download:

1. Log out
2. Log in as a test user with the required level
3. Click the download button
4. Verify the file downloads correctly
5. Log in as a user WITHOUT the required level
6. Verify they see an access denied message

Part 8: Common Issues and Solutions

Issue 1: Download Returns 404 Error

Cause: Rewrite rules not flushed.

Solution:

1. Use the rewrite flush tool under the global Settings maintenance tools, or resave the affected download so BRM schedules a rewrite flush
2. This refreshes the secure download routes
3. Try the download again

Issue 2: File Not Found Error

Cause: File doesn’t exist in the protected directory.

Solution:

1. Go to BricksMembers → Protected Downloads
2. Edit the download
3. Re-upload the file

Issue 3: Access Denied for Authorized Users

Cause: User doesn’t have the required level, or level assignment is incorrect.

Solution:

1. Go to Users → All Users in WordPress
2. Find the user and verify they have the required level
3. Go to BricksMembers → Protected Downloads
4. Edit the download and verify the Required Levels are correct

Issue 4: Direct URL Access Works (Security Breach)

Cause: Storage is publicly reachable or server-level blocking is missing/not working for the fallback directory.

Solution:

1. Confirm whether files are stored in private storage outside the public web root or in a public fallback directory
2. If using Nginx with public fallback storage, add a deny rule for the actual fallback storage path, for example:

location ~ /wp-content/brm-private/downloads/ {
    deny all;
    return 403;
}

3. If using Apache and public fallback storage, verify .htaccess exists in the downloads storage directory
4. Check file permissions (should be 644)

Issue 5: Large Files Timeout During Upload

Cause: PHP upload limits or execution time limits.

Solution: Increase PHP Limits

Add to wp-config.php:

@ini_set('upload_max_filesize', '100M');
@ini_set('post_max_size', '100M');
@ini_set('max_execution_time', '300');

Issue 6: Download Button Shows for Unauthorized Users

Cause: Conditions not set correctly.

Solution:

1. If using the BRM Protected Download element, it automatically hides for unauthorized users
2. If using a custom button, add condition: BricksMembers → User level match → is → Yes
3. Or use the {brm_download:url} dynamic tag with a condition that checks if it’s not empty

Part 9: Advanced Use Cases

Use Case 1: Integration with Progress Tracking

Add downloads to lesson pages that users can access after completing the lesson.

Steps:

1. Add a BRM Progress Checkbox element to the lesson page
2. Add a BRM Protected Download element below it
3. Users mark the lesson complete, then download the workbook

Use Case 2: Integration with Webhooks

Automatically grant access to downloads when users purchase.

Steps:

1. Create a user level: “Course Buyer”
2. Assign this level to all course downloads
3. Set up a webhook from your payment processor
4. Map the product to the “Course Buyer” level

Result: When users purchase, they automatically get access to all downloads.

Summary

You’ve learned how to:

• ✅ Understand how protected downloads work (security architecture)
• ✅ Enable and configure the Protected Downloads module
• ✅ Create and manage protected downloads
• ✅ Add download buttons and lists to pages with Bricks Builder
• ✅ Use query loops for custom download displays
• ✅ Track download activity
• ✅ Follow best practices for file security
• ✅ Troubleshoot common download issues
• ✅ Implement advanced use cases (drip releases, bundles)
• ✅ Integrate downloads with other BricksMembers features

Your digital products and member resources are now secure and accessible only to authorized members!