2

I am currently running a fairly popular private Wordpress site on a dedicated bare metal server using ISPConfig, Nginx and MariaDB. We have a series of podcasts and content that we host specific for our members. We are having an issue where certain users are sharing the site's links on other sites which is making our private content public. What I am looking to do is secure our content to prevent the links from working from the outside and to prevent this from happening again.

I have tried a few methods so far which has come up with it's own issues. My first attempt was to use Nginx's hotlink protection method by using the valid_referer directive. While this method did work it created issues with some browsers and prevented members with RSS/Podcast readers from downloading content.

The second use was a Wordpress plugin which uses PHP, WP-DownloadManager. Again this method did work but once again causes issues with some browsers and devices and doesn't work with RSS/Podcast readers.

I've seen a few methods used on another private podcast was the use of a key-based method. I'm already using a key method to keep the actual RSS feed private but the actual media file is not. This method also puts a key on the media file's URL just like it does with the RSS feed, and the links expire after a set time. I believe this method would be basically killing two birds with one stone. First, it should prevent people from sharing the link and if people are dumb enough to do so potentially any traffic generated from said link could be identified and tied to a specific member.

Is there a way for this to happen and any code available? Is there any other method that might be better? I'm currently at a loss and my members, especially iOS users, are getting a little upset since I pulled the RSS feeds.

Right now I'm currently using Wordpress with the Blubrry PowerPress plugin for podcasts and a slightly modified version of the Private Feed Key plugin which protects the Wordpress RSS feed. Members are required to login to the site and is unavailable to guests.

  • I do not have any answers for you, but I have a question that may help someone who would- if you do not mind. Are you requiring your users to log in? This is where I am confused by your question. I am assuming that would be the first step. If so, how is this not helping your situation? – closetnoc Jan 18 '15 at 3:39
  • Correct. Users are required to log in through Wordpress. – RyanThaDude Jan 18 '15 at 3:50
  • I do not know WP and so I do not think I can help you. Someone will. It has been quiet here on the weekends since the holidays. Must be the cold air? Who knows. Just hang tight. I will up-vote the question to get peoples attention at least. – closetnoc Jan 18 '15 at 4:10
  • Have you considered modifying your htaccess rules on the server to redirect them to an advertising page if they try to link content from another site? – Jamin Quimby Jan 18 '15 at 19:02
  • You will need to embed drm into the content, which may cost you licensing money to implement. Otherwise, content is just a file or collection of files that people can do whatever they want with – Canadian Luke REINSTATE MONICA Jan 18 '15 at 22:57
1

To make content on the internet private, you need to protect it with user names and passwords. Ensure that only logged in users with permissions can view the content.

You could implement basic authentacation via your .htaccess file or use one of several WordPress plugins such as this one.

  • 1
    This, unfortunately doesn't help. You make a suggestion to use .htaccess but I'm using Nginx instead of Apache. Plus, my Wordpress site is already made private with jonradio Private Site plugin and Secure Invites to allow my members to invite others. I'm also using Private Feed Key to protect the actual RSS feed so prevent non-members access to the feed, but I am looking to also protect the podcast media from being shared since the media currently is open to all as long as they have a link. I'm looking to protect the media, with something like expiring links. – RyanThaDude Jan 18 '15 at 22:31
  • Why wouldn't you put the media behind the same password protection as everything else? – Stephen Ostermiller Jan 19 '15 at 1:08
  • As far as I know most podcast and RSS readers won't work with password-protected media. The reader will fail to download any attached media. I know this happens in iTunes and BeyondPod for Android. I can only assume others will do the same. – RyanThaDude Jan 19 '15 at 1:55

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.