title: Only allow access to files in directory from the website they are a part of
body: <p>I know there are a lot of similar questions out there, and I've trawled them all, but I can't seem to get any of the solutions to work.</p>
  
  <p>I have a folder on the root of my website containing uploaded files that can be viewed and downloaded from the site when a user is logged in. They are here: <a href="https://example.com/uploads" rel="nofollow noreferrer">https://example.com/uploads</a> (for example). I need the site to continue to be able to access them to display them (some are images) and provide links for download (pdfs etc) so the user can download them, but I want to avoid anyone who get's hold of the url of a particular file being able to download them directly, like this: <a href="https://example.com/uploads/2020/02/myfile.pdf" rel="nofollow noreferrer">https://example.com/uploads/2020/02/myfile.pdf</a>. OR these urls getting into search engines (or if they do, the server prevents them from being accessed directly.</p>
  
  <p>I've tried adding an .htaccess file in the uploads directory with the following content:</p>
  
  <pre><code>Order Deny,Allow
  Deny from all
  Allow from 127.0.0.1
  </code></pre>
  
  <p>And I've tried</p>
  
  <pre><code>Order Allow,Deny
  Deny from all
  Allow from 127.0.0.1
  </code></pre>
  
  <p>...as I read that might allow HTTPS calls from the site itself as well as local urls.</p>
  
  <p>But it forbids the site and a direct url request, which is no good.</p>
  
  <p>Is there a way to do this?</p>