WordPress Private Files: How to Share Files with Specific Users

WordPress has no private files: everything you upload gets a public URL.
Here's how to give each client, member or student their own files, lock direct links, and share folders with specific user groups.

Why WordPress files are never private by default

When you upload a PDF to the Media Library, WordPress saves it in /wp-content/uploads/ with a predictable address like yoursite.com/wp-content/uploads/2026/10/contract.pdf. That address works for everyone. It doesn't matter if the page linking it is private, password protected or visible only to members: whoever has the link, or guesses it, downloads the file. Search engines can index it too.

So "hiding" a file means two separate things, and you need both:

• Hiding the link, so only the right users see it on the page
• Protecting the file itself, so the server refuses to deliver it to anyone else

Most solutions only do the first. That's the gap this guide closes.

4 ways to share private files in WordPress, compared

If all you need is a shared folder, a file-sharing plugin can be enough. If those files live inside a real client area, with private pages, a personal dashboard and registration forms, a single system that manages users, content and files together saves you from gluing three plugins together. That's what PrivateContent does.

Want to see it live first? Log in to the Files Manager demo with the two test users and compare what each one sees, or start your free 7-day trial.

What you need

• WordPress 5.5 or newer
• PrivateContent, which manages your private users and user categories, separate from WordPress accounts
• The Files Manager add-on
• At least one user category and one user. Starting from scratch? Follow the initial required steps first

How the protection works

Files Manager doesn't use the Media Library. Files are stored in a dedicated folder (wp-content/uploads/pc_files) that blocks direct access, and they're delivered through links like yoursite.com/pcfm/123/contract.pdf. Every time one of these links is opened, the plugin checks who is asking before sending the file. A visitor who isn't logged in, or a user without permission, gets an error page instead. Sharing or guessing a link gets nobody anywhere.

Method 1: share files with one specific user

Best for invoices, contracts, reports, project deliverables and anything that belongs to one person only. You create an upload field once, then fill it with files for each user.

Step 1: create an upload field

1. In the WordPress admin, go to PrivateContent → Files Manager. This is the Files Hub
2. Open the Upload Fields tab and click Add Field
3. Give it a clear Field label, for example "Client documents". The Field index is generated from the label if you leave it empty; you'll use it in the shortcode
4. Choose the Allowed file types (for example PDF, DOCX, XLSX, ZIP) and, if needed, Maximum files and Maximum file size
5. Pick the Field type:
   • Basic: a simple list of files, no folders
   • Common subfolders: the same folders for everyone, for example "Invoices" and "Contracts"
   • Admin-defined subfolders: you create the folders for each user
   • Free folders structure: users can create their own folders too
6. Click Update Fields

Step 2: upload files to a specific user

1. Go to PrivateContent → Users List and open the user's dashboard
2. Open the User Files tab: there's a box for each upload field
3. Click Upload files in the "Client documents" box and select the files. If the field has folders, choose the folder first

Done: those files now belong to that user only. Nobody else can see or download them, not even users in the same category.

Step 3: show each user their own files

Create a page, for example "My documents", and add this shortcode, replacing client-documents with your field index:

[ pcfm-user-files-manager field_id="client-documents"]

Each logged-in user sees a desktop-like file manager with only their own files, with search, sorting and folders. Visitors who aren't logged in see nothing. Optional parameters: files_per_page (default 20), sorting (for example id_desc, newest first) and date_format.

Prefer a read-only list with a different look? Create a File View: in the Files Hub open File Views, set What to display? to User Upload Fields, choose your field and a layout (seven are available, from simple lists to image previews), save, and paste its shortcode:

[ pcfm-files-view view_id="12"]

Want everything in one place? Put the shortcode inside the Users Reserved Page: every client lands on a single URL showing their own content and their own files. We explain the full setup in how to show a private page to each user.

Method 2: share files with a group of users

When the same files go to many people (price lists for resellers, material for one class, documents for a client's whole team) use Restricted Files and decide who can open each folder.

Step 1: create folders and upload files

1. Go to PrivateContent → Files Manager and stay in the Restricted Files tab
2. Click the + icon next to Root to add a folder, for example "Reseller price lists". Subfolders can go as deep as you need
3. Select the folder and click Upload File

Step 2: choose who can access each folder

1. Open the folder's restrictions and use Allows to pick the user categories that can access it, for example "Resellers". You can also choose Any logged user, or Anyone for a public folder
2. Use Blocks to exclude categories that would otherwise be allowed
3. Optionally set a Downloads limit per user
4. Click Save folder restrictions

Subfolders inherit their parent's rules until you change them, so you set things up once at the top. Single files can also get their own restrictions when one document needs different rules from its folder.

Step 3: publish the files

Create a File View with What to display? set to Restricted Fields, choose the folder and a layout. For bigger archives set Extra view mode to Folders navigator, so users can browse subfolders like on their computer. Paste the view shortcode on any page: each user only sees the folders and files their category allows.

Which method should you use?

Let users upload files to you

File sharing usually goes both ways: you send reports, clients send back signed contracts, receipts or photos. Upload fields handle that too:

• add an upload field to a PrivateContent registration form or profile form, for example to collect documents at sign-up
• or let users drag and drop files into the frontend file manager from Method 1

File types, size, number of files and even image dimensions are validated automatically. You'll find every user's uploads in the User Files Search tab of the Files Hub, with filters to narrow them down.

Notifications, download limits and tracking

• Email the user when new files arrive. With the Mail Actions add-on a Notify user button appears next to Upload files. You can also be emailed when users upload something
• Limit downloads per user, per folder or per upload field
• Track downloads as Google Analytics events, or get a full per-user log with the User Activities add-on
• Preview without downloading: images, videos and PDFs can open in a lightbox

Real-world use cases

• Accountants and consultants: each client finds their invoices, tax returns and reports in a personal area
• Web and design agencies: deliver drafts and final files per project, and collect material from clients
• B2B and wholesalers: price lists and catalogs visible only to approved resellers. Pair it with hidden WooCommerce prices for guests
• Schools and course creators: material per class or per student, with download limits
• Photographers: each client gets their own set of final images, previewed in a lightbox

Building a complete area for your clients? Read how to create a private client portal in WordPress.

Frequently asked questions