If you run a WordPress membership site — whether you’re selling access to photography, online courses, premium video, or downloadable resources — there’s a gap in your content protection that you might not know about.
Your membership plugin (MemberPress, Paid Memberships Pro, or even basic WordPress login) controls who can see your pages. But the images, videos, and documents on those pages? Anyone with the URL can access them directly. No login. No membership. No payment.
The Problem
Every image, video, PDF, and audio file you upload to WordPress lives in `/wp-content/uploads/`. When a member views your protected page, their browser loads those files using their full, original URLs. Those URLs are visible in the page source, in the browser’s network inspector, and in browser history.
If a paying member copies an image URL and shares it — the recipient can download your premium content without ever visiting your site. If search engines index your uploads directory — your premium images show up in Google Image Search, accessible to anyone.
Your membership plugin can’t prevent this. By the time WordPress checks whether someone is authorized to see a page, the media file URLs are already in the HTML. And those files are served directly by your web server (Apache, Nginx) without any authorization check.
This isn’t a bug in your membership plugin. It’s how WordPress works.
The Solution: XYZ Protect
Today we’re launching XYZ Protect, a WordPress plugin that closes this gap.
XYZ Protect rewrites your media URLs so they route through a protection layer that verifies authorization before serving any file. Unauthorized visitors see a placeholder image instead of your premium content. Your files never move, your server configuration doesn’t change, and it works on any WordPress host.
Two Protection Modes
**Guard Cookie** — Media URLs are obfuscated and only accessible to visitors with a valid authorization cookie. Fast, simple, and compatible with page caching plugins like WP Rocket and LiteSpeed Cache. Best for most membership sites.
**Encrypted URL** — Each media URL is unique to the individual visitor and expires automatically. Even if someone extracts a URL from page source, it won’t work for anyone else and stops working after the time window closes. Best for high-value content like premium photography, exclusive video, and confidential documents.
**Tiered Mode** lets you run both simultaneously — standard members get Guard Cookie protection while premium members get Encrypted URLs. Map protection levels directly to your membership tiers.
Built-In Membership Plugin Support
XYZ Protect auto-detects your membership plugin and integrates natively:
– **MemberPress** — All editions (Launch, Growth, Scale). Map each membership level to a protection tier. No MemberPress add-ons required.
– **Paid Memberships Pro** — Works with the free core plugin. No premium PMPro plan or add-ons required.
– **WordPress Login** — Any logged-in user is authorized. No membership plugin needed.
No Server Changes. No File Moves. Any Host.
Other file protection plugins require `.htaccess` rules, Nginx configuration, or physically moving your files to hidden directories. XYZ Protect requires none of that. Install the plugin, add three DNS records, choose what to protect, and you’re done. Works on shared hosting, managed WordPress (WP Engine, Kinsta, SiteGround), VPS, dedicated servers, and WordPress.com Business plans.
Deactivate the plugin and your site is exactly as it was before. No files moved, no URLs broken, no cleanup required.
Who Is This For?
XYZ Protect is built for anyone whose media files have real value:
– **Photographers** protecting premium galleries and high-resolution downloads
– **Course creators** securing lesson videos, workbooks, and resources
– **Content creators** gating exclusive images, audio, and documents behind a paywall
– **Publishers** restricting access to premium reports, research, and data visualizations
– **Adult content sites** that need both media protection and age verification
If your content is your product, XYZ Protect makes sure only paying members can access it.
Built-In Age Verification
For sites serving age-restricted content, XYZ Protect includes region-based adult verification. Visitors from regulated jurisdictions are verified before they can view content. Privacy-first — images are processed in memory only and never stored. Verification credits start at $0.038 each, a fraction of what other providers charge.
Simple Pricing
$15/month or $150/year. All features included — Guard Cookie, Encrypted URL, Tiered mode, MemberPress and PMPro integration, unlimited protected files, automatic key rotation. No per-request fees for media protection.
Free trial includes 10,000 protected media requests. No credit card required.
Try It Yourself
Here’s a quick way to see if your site has this problem: visit one of your membership-protected pages while logged in. Right-click an image, copy the URL, and open it in an incognito window where you’re not logged in. If the image loads — your media isn’t protected.
Learn more and start your free trial at https://www.xyzinc.com/protect.
—
*XYZ Protect is developed by Chaos Unlimited LLC, the team behind XYZ Age Verification — privacy-first identity verification for regulated industries.*