Private folders

Overview

A private folder is a folder of your site that nobody can open from the web, not even with the exact address of a file. Inside DooFiles, only the administrators you choose can open it, and only after they confirm their password.

Use it for files that live on your server but must never be public, such as exports, client documents or backups of your own.

Before a folder becomes private, DooFiles checks with a real request that your server keeps it closed. It checks it again every day.

Which folders can be private

A private folder must be a folder of your own, outside the folders of WordPress. For example, a folder at the top level of your site, such as /client-files.

These cannot be private:

• the main folder of your site;
• the folders of WordPress, such as wp-admin, wp-includes, wp-content and its plugins, themes and uploads folders, anything inside them, and any folder that contains them;
• a folder with another WordPress installation inside;
• a folder inside another private folder, or that has a private folder inside;
• shortcuts (symbolic links), and folders that the server does not let DooFiles write to.

A folder can have up to 200,000 files to be made private.

Make a folder private

1. In the file list, right-click the folder and choose Make private….
2. Choose the administrators who can open it. Only administrators who can use DooFiles appear in the list. If you leave yourself out, you will not be able to open it.
3. Click Make private, and confirm your password (and your second factor, if you use one).

DooFiles closes the folder, checks with a real request that your server keeps it closed, and shows “client-files” is now private. The folder shows a padlock in the list.

If the folder contains a .htaccess or web.config file, DooFiles asks you to remove it first, because it could open the folder again.

[SCREENSHOT_HERE: The Make "client-files" private? dialog with the list of administrators and the Make private button]

On nginx servers

Apache, LiteSpeed and IIS close the folder with the rules that DooFiles adds. nginx ignores those rules, so DooFiles does not make the folder private, and shows you the rule to add instead:

location ^~ /client-files/ {
    deny all;
}

Add the rule that DooFiles shows inside the server block of your site, in the configuration of nginx, reload nginx, and try again. If you do not manage your server, send the rule to your hosting provider.

The first time, DooFiles may also ask you to close its own Trash and backups folder in the same way, because files from private folders pass through it.

See Server configuration.

Open a private folder

Administrators on the list open it like any other folder, after they confirm their password. Inside, a notice reminds them: Private folder “client-files”: it cannot be opened by URL, and here only the administrators on its list can open it.

Other administrators see the folder with a padlock, but cannot open it: This folder is private and you are not on its list.

Change who can open it

Right-click the private folder and choose:

• Who can open it… to add or remove administrators, then Save.
• Make public… to make it a regular folder again. DooFiles removes its rules, and the folder can be opened by address again. The files stay where they are.

Both ask for your password.

Claim a folder that nobody can open

If every administrator on the list was deleted, or DooFiles was installed again, nobody can open the folder. Any administrator can then right-click it and choose Claim…, confirm the password, and become the only one on its list. This is recorded in the Activity log.

What else changes for a private folder

To keep its files private, DooFiles also:

• does not compress a private folder from outside, nor delete or compress a folder that contains one, so its files never end up in a public zip file or in the wrong place;
• does not move a private folder inside another private folder or a WordPress folder;
• does not allow .htaccess or web.config files inside it, by creating, uploading or extracting them;
• does not search inside it;
• shows its items in the Trash and its entries in the Activity log only to the administrators on its list.

The daily check

Every day, DooFiles checks again that each private folder is closed to the web and still where it was. If one can be opened by address again, or is no longer there, the WordPress admin shows a notice: DooFiles: a private folder can be opened by URL again or is no longer where it was., with a link to review it.

The Private folders card

DooFiles › Settings lists every private folder in the Private folders card:

Each folder also shows who can open it. Click Check now to check it right away. The card also shows the state of the DooFiles Trash and backups folder, which must be closed too.

[SCREENSHOT_HERE: The Private folders card in Settings with a folder Closed to the web, who opens it, the last check and Check now]

Deleting DooFiles keeps your private folders closed. If you install it again, an administrator can claim them.

Troubleshooting

Need more help? Open a support ticket.