Protecting Your Uploads Directory

By default, StoreEngine places a .htaccess file in the wp-content/uploads/storeengine_uploads directory to prevent direct access. However, this alone does not fully guarantee protection since server configuration also plays a role and works only if your server is running Apache.

Using NGINX Server

If your site runs on NGINX, we recommend adding extra rules to block direct access to uploaded files for better security.

Add the following snippet at the end of the server block in your NGINX configuration:

# Protect StoreEngine upload folder from being accessed directly.
location ~* /wp-content/uploads/storeengine_uploads/ {
    if ( $upstream_http_x_accel_redirect = "" ) {
        return 403;
    }
    internal;
}

This ensures that files in your StoreEngine upload folder cannot be accessed directly via the browser.