I am currently running a fairly popular private Wordpress site on a dedicated bare metal server using ISPConfig, Nginx and MariaDB. We have a series of podcasts and content that we host specific for our members. We are having an issue where certain users are sharing the site's links on other sites which is making our private content public. What I am looking to do is secure our content to prevent the links from working from the outside and to prevent this from happening again.

I have tried a few methods so far which has come up with it's own issues. My first attempt was to use Nginx's hotlink protection method by using the valid_referer directive. While this method did work it created issues with some browsers and prevented members with RSS/Podcast readers from downloading content.

The second use was a Wordpress plugin which uses PHP, WP-DownloadManager. Again this method did work but once again causes issues with some browsers and devices and doesn't work with RSS/Podcast readers.

I've seen a few methods used on another private podcast was the use of a key-based method. I'm already using a key method to keep the actual RSS feed private but the actual media file is not. This method also puts a key on the media file's URL just like it does with the RSS feed, and the links expire after a set time. I believe this method would be basically killing two birds with one stone. First, it should prevent people from sharing the link and if people are dumb enough to do so potentially any traffic generated from said link could be identified and tied to a specific member.

Is there a way for this to happen and any code available? Is there any other method that might be better? I'm currently at a loss and my members, especially iOS users, are getting a little upset since I pulled the RSS feeds.

Right now I'm currently using Wordpress with the Blubrry PowerPress plugin for podcasts and a slightly modified version of the Private Feed Key plugin which protects the Wordpress RSS feed. Members are required to login to the site and is unavailable to guests.

  • I do not have any answers for you, but I have a question that may help someone who would- if you do not mind. Are you requiring your users to log in? This is where I am confused by your question. I am assuming that would be the first step. If so, how is this not helping your situation?
    – closetnoc
    Commented Jan 18, 2015 at 3:39
  • Correct. Users are required to log in through Wordpress. Commented Jan 18, 2015 at 3:50
  • I do not know WP and so I do not think I can help you. Someone will. It has been quiet here on the weekends since the holidays. Must be the cold air? Who knows. Just hang tight. I will up-vote the question to get peoples attention at least.
    – closetnoc
    Commented Jan 18, 2015 at 4:10
  • Have you considered modifying your htaccess rules on the server to redirect them to an advertising page if they try to link content from another site? Commented Jan 18, 2015 at 19:02
  • You will need to embed drm into the content, which may cost you licensing money to implement. Otherwise, content is just a file or collection of files that people can do whatever they want with Commented Jan 18, 2015 at 22:57

1 Answer 1


To make content on the internet private, you need to protect it with user names and passwords. Ensure that only logged in users with permissions can view the content.

You could implement basic authentacation via your .htaccess file or use one of several WordPress plugins such as this one.

  • 1
    This, unfortunately doesn't help. You make a suggestion to use .htaccess but I'm using Nginx instead of Apache. Plus, my Wordpress site is already made private with jonradio Private Site plugin and Secure Invites to allow my members to invite others. I'm also using Private Feed Key to protect the actual RSS feed so prevent non-members access to the feed, but I am looking to also protect the podcast media from being shared since the media currently is open to all as long as they have a link. I'm looking to protect the media, with something like expiring links. Commented Jan 18, 2015 at 22:31
  • Why wouldn't you put the media behind the same password protection as everything else? Commented Jan 19, 2015 at 1:08
  • As far as I know most podcast and RSS readers won't work with password-protected media. The reader will fail to download any attached media. I know this happens in iTunes and BeyondPod for Android. I can only assume others will do the same. Commented Jan 19, 2015 at 1:55

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.