I need to create a news/blog section only accessible to logged in members. I know I can restrict templates to members and use {if logged_in} to restrict displaying fields etc.

I am looking for advice on how best to approach restricting access to images shown and file links included within the blog, so that the URLs to these do not let general site visitors / search engines etc access the files and images.

Ideally, the blog admin could write blog posts in a wyswiyg (wygwam) field including images and file links there. If that's not possible, extra fields for images and file links could be used.

I figure this is a common enough requirement, so I would really appreciate some guidance on how best to approach this. Thanks.

2 Answers 2


First, you'd have to set up your upload directory to be below the web root, so your structure might look like this:


Make a template for serving up these protected images, say protected/images is your template group / template name. Set your upload directory's URL to this template: /protected/images/

In your template, enable PHP (or convert this to a plugin):

// set this to your real file upload path
$path = '/var/www/private/uploads/';


// they're logged in, show 'em the image
if ($this->EE->session->userdata('member_id'))
  $filename = $this->EE->uri->segment(3);

  if ( ! $filename || ! file_exists($path.$filename))

    echo file_get_contents($path.$filename);

This is intended to be just a starting point, your mileage may vary.

  • Thanks for taking the time to reply Rob. Had done something similar to this in past just for download file link fields. With this approach, is linking to files and images within wysiwygs possible, or does every file/image link need to be in its own field and then i can have <img src="/protected/images/private.jpg"> and the template code above should display it inline in the page?
    – Janine
    Mar 11, 2013 at 10:04
  • You should be able to use WYSIWYGs as you normally would, since they'll render as <img src="/protected/images/private.jpg">, and thus will hit your protected files-serving template. If someone was logged out, they'd see missing image markers in their browser. You might want to do something like instead of just 401'ing, print out a default image that says something like "Images not displayed for guests". Mar 11, 2013 at 14:16
  • Thanks for the further info Rob and great to hear that it should work with wysiwyg managed content.
    – Janine
    Mar 12, 2013 at 23:29

Consider Protected Links add-on.

It can protect both files to download and images on page. For images, you will need to use 'inline' parameter. It is also advicable to place actual files/images above web root, like Rob Suggested.

  • Thanks for replying Yuri. I had seen your add-on but hadn't realised that it could be used for including images in a web page. Will your add-on work if the client is just linking to files and images within a wysiwyg, or can it only protect links added via custom file fields?
    – Janine
    Mar 11, 2013 at 10:07
  • It can protect files and links that are stored as fields of type File, Assets, Channel Images etc. - as long as you can get file path/URL and pass it as parameter to Protected Links. In cannot be used to hide URL for images added using WYSIWYG (uless you perform extensive search & replace there)
    – Yuri Salimovskiy
    Mar 11, 2013 at 11:03
  • Thanks for the extra info Yuri. I would like to accept both your answer and Rob's, but I think I can only accept one. So have upvoted yours which I think is the best I can do, and just chose to accept Rob's instead as it allows for wysiwyg managed content more easily. Thanks
    – Janine
    Mar 12, 2013 at 23:31

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.