PDA Private Magic Links

The expiring link breaks on your own page

To keep a PDF from circulating, you give it a temporary link. It works: whoever forwards it arrives too late. But that same link is pasted on a page of your site, and when it expires it also stops opening for the member who rightfully logs in today.

A temporary link trades a security risk for a maintenance task: someone has to paste it again every time it expires.

Private Magic Links is an extension for Prevent Direct Access Gold that removes that task. It replaces the address of a protected file with a temporary token inside the content. When the token expires, it creates another and updates the page by itself. Authorized users keep seeing a valid link, and anyone using an expired one gets an error.

Links that renew and control per user

• Common expiry: you set one time for all magic links.
• Automatic replacement: swaps the addresses of newly protected files for expiring links.
• Renewal: generates the new link and updates it in the content when the previous one expires.
• Access by role: you choose which users can view protected images, files and documents.
• Images and PDFs: displays PNG, JPEG and PDF files normally and blocks direct access to their addresses.

Shared Private Links solves a different need: a single link for an entire role. Each user has their own download counter and their own expiry, which starts at their first click. If you edit the values, the difference applies to those who already used it. Going from unlimited to two, someone who clicked twice loses access and someone who clicked once keeps one more.

A members guide with an address that expires

A typical case is a document reserved for members. You protect it and insert it in the private page like any file. With magic links, the address a member copies today stops working when it expires, while the page keeps showing a valid one.

If you also want to limit how many times each person downloads, add a Shared Private Link for the member role, with a download limit and days of validity. For a whole page only for subscribers, it combines with Protect Pages & Posts Gold. Test each combination with an account in that role before opening it to your users.

Validity times and cases without coverage

• Initial value: links last one minute by default, so it is worth choosing a time suited to your files.
• Changing expiry: the current link keeps its value until it expires, or until you deactivate or delete it.
• One link per file: only one magic link is active at a time, and only one Shared Private Link per file.
• Scope: search and replace acts on pages and posts by default. There is a filter for other content types, and it is worth checking the result with WooCommerce products.
• Raw addresses: it does not work with URLs written as plain text.
• Force Download: it conflicts with that Prevent Direct Access Gold function.
• Prevent Direct Access S3: its search and replace conflicts with the extension.

Required plugins and setup steps

It is an extension and does not work alone. You need one of these plugins: Prevent Direct Access Gold, Prevent Direct Access S3 or Protect Pages and Posts Gold.

1. Install Prevent Direct Access and its Gold version, then this extension.
2. Enable auto-protection and the download link settings.
3. Open the Prevent Direct Access Gold settings and the Magic Links tab.
4. Set the expiry time and the roles with access.
5. Upload a file, insert it in a page and look at the link on the site.
6. Reload the page after the time runs out to confirm a new token appears.

Page and download protection to compare

If what you want to close is the page and not the file, Password Protect WordPress Pro controls who sees pages, posts or sections with a password and no account.

If you prefer sending files to specific people, WordPress File Hosting & Sharing gives each user folders and links that stop working after a number of downloads or minutes.

Answers about Private Magic Links

Do I have to insert the files again?

No. You protect and insert as usual, and replacement is on by default.

When does a Shared Private Link start counting?

At each user's first download, not when the link is created.

What happens if I deactivate a magic link?

It becomes a normal private link that is no longer deleted automatically.