I have a file upload directory above root in a folder called "secure_files". I can successfully upload files to this directory from within my Assets field. The file upload directory is setup like below...

Server Path to Upload Directory: /Users/mlohrman/Sites/secure_files/

URL of Upload Directory: ../

here's my template code..."file_upload_matrix" is my matrix field. "files" is the column with the Assets field in it. This successfully displays the files on the front end.

    <a href="{url}">{title}</a>

The URL on the front-end is "../file.pdf". So when I'm on this page "http://site.com/departments/marketing/files/" it's trying to find the file at "http://site.com/departments/file.pdf".

Now I've done something similar using DevDemon Channel Files and had the same file upload settings and that plugin has a built in obfuscated links feature. I'm not sure what's happening behind the scenes, but setting the file URL to obfuscated would allow a person on the front-end to download that file that was sitting in the folder above root. I know Assets doesn't have the obfuscated link feature, but I thought I could try Link Vault plugin to do that for me. But I'm not positive the URL is correct now to pass to Link Vault. Any thoughts?

2 Answers 2


You can definitely use Link Vault to serve files that are above web root. There are a few different ways to construct a download link with Link Vault. Link Vault expects the path supplied to be relative to the web root so any one of these would work :

{exp:link_vault:download_link directory='../../files/' file_name='file.zip' }
{exp:link_vault:download_link file_path='../../files/file.zip' }

If the file does happen to be below web root, you can even use :

{exp:link_vault:download_link file_path='http://example.com/images/cat.jpg' }

The link that is generated gets encrypted so your files are safe and hackers can't just modify the parameters to go searching through your files (abbreviated example) :


We're always available in the support forum if you need help.

  • Just tried it out and it worked great, thanks! Feb 25, 2013 at 16:09

This could work with Link Vault or any of the link-obsfucation plugins (CartThrob has one built-in, for example). Just pass the plugin the {server_path} Assets variable.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.