Is there a way to protect Drupal files from being accessible by the file path (putting http://www.domain.com/files/image.jpg) in the browser URL from users poking around?

2 Answers 2


You can choose to let Drupal handle all file requests, this is done under file settings be selecting private files (admin/settings/file-system).

The access check is done in hook_file_download.

You should be aware that doing this will slow down the process of loading the files as Drupal has to be bootstrapped for every file that needs to be downloaded.


The above method works be changing the file path created by file_create_url to a path that looks something like this: system/files/[path]. But I don't actually think that it prevents users from accessing the file directly. This would have to be setup in your webserver of choice. So all files would be protected that implement use file_create_url which should be any file/file link. Drupal also add some handling core files like user profile images. That leaves the access handling for all other files to you, which means you could allow imagecache files, while denying the original or whatever you like.

  • hook_file_download applies also to images within content? Not just a download link?
    – Kevin
    May 11, 2011 at 20:48
  • 1
    Yes, everything. Drupal 7 allows to configure the file system per field, however
    – Berdir
    May 11, 2011 at 23:08

I see two ways of doing that:

  1. Change the "files-mode" to private via admin/settings/file-system (as googletorp stated) AND changing the filepath to somewhere outside of your webserved files.

  2. Change the "files-mode" to private and set some rewrite rules inside your .htaccess (or elsewhere in your webserver config). this gives you more control which files you want served private and which public. Something like:

    RewriteEngine On
    RewriteCond %{REQUEST_URI} ^/sites/default/files/(private/.*)$
    RewriteRule ^.*$ /system/files/%1 [L]

Now every request directly to the "private" files will be rewritten to the systempath which is controled by drupal. So no access without drupal is possible.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.