This will probably not be possible, but here goes nothing:

I have entries that are password protected using the Template Guard plugin. While this does work perfectly, this does only password protect the entry its self. Any assets uploaded to this entry are (obviously) still publicly accessible when using their asset URL. But as far as I know, all assets need a public URL to be able to upload them in the control panel and display them in templates.

Or is there any way to block public URL-access to these assets (maybe a specific volume)?

2 Answers 2


You could create what I call a "traffic controller" template.

Route asset requests via the routes config to a template that checks whatever conditions you want, and then either returns a 503 Forbidden, a redirect to the proper login page, or calls the asset.

Do note - this is sucky for some performance reasons (you're adding an extra step and route to all of your asset calls)

This also isn't a great idea if your site is highly interested in image SEO (art gallery, e-commerce, photographer, etc.)

It's a quick and brute-force way to do it, but it's a way.

Also - if not already doing so, you can set up a robots.txt to NOT index specific image paths to prevent crawlers from finding them. SEOMatic has settings to omit them from the sitemap too. Best of luck!

  • How do you route "asset requests" specifically? I'm messing around with routes.php and as far as I can tell a url that matches a literal file location (eg mysite.com/uploads/myfile.jpeg) will get served even if I have a route for 'uploads/<filename>'.
    – Brimby
    Nov 20, 2023 at 21:45

We use a self-programmed "secure assets" plugin for this. It restricts access via the URLs to logged-in users. I will ask if and when we will make this available in the plugin store.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.