[Resolved] Protecting Files/Media

I wanted to protect certain posts, pages, and files/media and decided to give it a try using categories. To that end, here is how I am able to achieve it. This is based on the idea from hakre @ stackexchange

First, you’re going to need some way to redirect downloads to a PHP file that can check authorization and either direct the user to login OR prompt the download to happen.

.htaccess [Root of WordPress site folder]

RewriteCond %{REQUEST_FILENAME} -s
RewriteRule ^wp-content/uploads/(.*)$ dl-file.php?file=$1 [QSA,L]

dl-file.php [Root of WordPress site folder]

<?php

// Using Simple Membership Plugin to verify the user has access to the file
function can_access_attachment($id) {

	$auth = SwpmAuth::get_instance();
	$protected = SwpmProtection::get_instance();

	//Check if this is a protected post.
	if (!$protected->is_protected($id)) {
		return true;
	}

	//Check if the user is logged in.
	if(!$auth->is_logged_in()){
		return false;			
	}

	//Check if the account is expired
	if ($auth->is_expired_account()){
		return false;						
	}
	
	//Check if this user's membership level has access to this post
	$permission = SwpmPermission::get_instance($auth->get('membership_level'));
	if(!$permission->is_permitted($id)) {
		return false;
	}
		
	//All checks have passed. Show this post to the user.
	return true;	
}

require_once('wp-load.php');

if ( !is_user_logged_in() || !SwpmMemberUtils::is_member_logged_in() ){
	auth_redirect();
}

list($basedir) = array_values(array_intersect_key(wp_upload_dir(), array('basedir' => 1)))+array(NULL);
list($baseurl) = array_values(array_intersect_key(wp_upload_dir(), array('baseurl' => 1)))+array(NULL);

$filename = basename($_GET['file']); 
$file_path = rtrim($basedir,'/').'/'.str_replace('..', '', isset($_GET[ 'file' ])?$_GET[ 'file' ]:'');
$url  = rtrim($baseurl,'/').'/'.str_replace('..', '', isset($_GET[ 'file' ])?$_GET[ 'file' ]:'');
$id = attachment_url_to_postid( $url );

if (can_access_attachment( $id )) {
	
	if (!$baseurl || !$basedir || !is_file($file_path)) {
		status_header(404);
		die('404 — File not found.');
	}
	
	$mime = wp_check_filetype($file_path);
	if( false === $mime[ 'type' ] && function_exists( 'mime_content_type' ) )
		$mime[ 'type' ] = mime_content_type( $file_path );
	
	if( $mime[ 'type' ] )
		$mimetype = $mime[ 'type' ];
	else
		$mimetype = 'image/' . substr( $file_path, strrpos( $file_path, '.' ) + 1 );

	header( 'Content-Type: ' . $mimetype ); // always send this

	if ( false === strpos( $_SERVER['SERVER_SOFTWARE'], 'Microsoft-IIS' ) )
		header( 'Content-Length: ' . filesize( $file_path ) );

	$last_modified = gmdate( 'D, d M Y H:i:s', filemtime( $file_path ) );
	$etag = '"' . md5( $last_modified ) . '"';
	header( "Content-Disposition: attachment; filename=$filename" );
	header( "Last-Modified: $last_modified GMT" );
	header( 'ETag: ' . $etag );
	header( 'Expires: ' . gmdate( 'D, d M Y H:i:s', time() + 100000000 ) . ' GMT' );

	// Support for Conditional GET
	$client_etag = isset( $_SERVER['HTTP_IF_NONE_MATCH'] ) ? stripslashes( $_SERVER['HTTP_IF_NONE_MATCH'] ) : false;

	if( ! isset( $_SERVER['HTTP_IF_MODIFIED_SINCE'] ) )
		$_SERVER['HTTP_IF_MODIFIED_SINCE'] = false;

	$client_last_modified = trim( $_SERVER['HTTP_IF_MODIFIED_SINCE'] );
	// If string is empty, return 0. If not, attempt to parse into a timestamp
	$client_modified_timestamp = $client_last_modified ? strtotime( $client_last_modified ) : 0;

	// Make a timestamp for our most recent modification...
	$modified_timestamp = strtotime($last_modified);

	if ( ( $client_last_modified && $client_etag )
		? ( ( $client_modified_timestamp >= $modified_timestamp) && ( $client_etag == $etag ) )
		: ( ( $client_modified_timestamp >= $modified_timestamp) || ( $client_etag == $etag ) )
		) {
		status_header( 304 );
		exit;
	}

	// If we made it this far, just serve the file
	readfile( $file_path );

}else{
	auth_redirect();
}

?>

functions.php

<?php
defined('ABSPATH') or die("Please don't run this script.");

function pages_and_media_with_category_and_tag_register(){
	/*add categories and tags to pages*/
	register_taxonomy_for_object_type('category', 'page');
	register_taxonomy_for_object_type('post_tag', 'page');
	register_taxonomy_for_object_type('category', 'attachment');
	register_taxonomy_for_object_type('post_tag', 'attachment');
}
add_action( 'init', 'pages_and_media_with_category_and_tag_register');

function pages_and_media_with_category_and_tag_register_pre_get( $query ) {

	if ( is_admin() || ! $query->is_main_query() ) {
		return;
	}

	/*view categories and tags archive pages */
	if($query->is_category && $query->is_main_query()){
		$query->set('post_type', array( 'post', 'page', 'attachment'));
	}

	if($query->is_tag && $query->is_main_query()){
		$query->set('post_type', array( 'post', 'page', 'attachment'));
	}
}
add_action( 'pre_get_posts', 'pages_and_media_with_category_and_tag_register_pre_get' );

The functions.php edit allows you to have categories for pages and media as well as posts.

With this setup you can set categories on all three and protect files from external linking. Let me know if you find any issues with this or bugs.