I'm trying to block my direct pdf url but unfortunately my pdfs are accessible directly from the url. I have already edit my htaccess file in which is stored in `/opt/bitnami/apps/wordpress/htdocs`

And my pfds are stored in `/opt/bitnami/apps/wordpress/htdocs/wp-content/uploads/securepdfs`

I have gone through these urls:

* [Wordpress protect file if not logged in](https://stackoverflow.com/questions/35547210/wordpress-protect-file-if-not-logged-in)
* <https://wordpress.stackexchange.com/questions/37144/how-to-protect-uploads-if-user-is-not-logged-in>

```
RewriteCond %{REQUEST_FILENAME} ^.*(pdf)$
RewriteRule ^(.*)$ /wp-content/download.php?file=$1 [L]

require_once('/path/to/wp-config.php');
require_once('/path/to/wp-includes/wp-db.php');
require_once('/path/to/wp-includes/pluggable.php');

if (!is_user_logged_in()) {
    // redirect to login page or show the message + login form
    die; // or exit, wp_redirect etc
}

header("Content-Type: application/octet-stream");

$file = $_GET["file"] .".pdf";
header("Content-Disposition: attachment; filename=" . urlencode($file));   
header("Content-Type: application/octet-stream");
header("Content-Type: application/download");
header("Content-Description: File Transfer");            
header("Content-Length: " . filesize($file));
flush(); // this doesn't really matter.
$fp = fopen($file, "r");
while (!feof($fp))
{
    echo fread($fp, 65536);
    flush(); // this is essential for large downloads
} 
fclose($fp); ```

All pdfs urls are public accessible
https://abc/wp-content/uploads/securepdfs/2019/05/Testing-pdf-1.pdf

```