There are two ways to protect a download, and they solve different problems.
The file library:
Files and Folders tab, then upload. The file lands in a sealed folder inside your uploads directory that the web server refuses to serve directly, so guessing the address gets you nothing. Members download it through a checked link.
Use it anywhere with the raxm_file shortcode, giving the file id and the link text. Download counts are tracked per file, so you can see what people actually use.
Whole folder protection:
Protects any folder under your site root. A course area full of HTML and video, or the download folders your previous membership plugin was guarding.
- Enter the path relative to your site root, for example courses/gold.
- Pick the levels that may see it.
- Save.
Every file in that folder and its subfolders then requires membership, and visitors without access are sent to log in.
How folder protection works:
A small .htaccess file is written into that folder, which routes every request through the membership check. Unprotecting removes only that block and leaves anything else in the file alone.
The nginx caveat, stated plainly:
nginx ignores .htaccess entirely, so whole folder protection does not work on an nginx server. Both the Files tab and Diagnostics warn you when that applies to yours. Use the file library and the raxm_file shortcode instead there.
Getting the path right:
Paths are relative to the folder WordPress is installed in, not to your domain. If your site lives in a subfolder, that subfolder is already assumed. On an install at /members/, the folder /members/files/bonuses is typed as files/bonuses.
You do not have to remember that. Paste the full web address, the server path, or the path with the subfolder still on the front, and the right one is worked out for you. Tick Create It If It Is Not There Yet and a folder that does not exist is made and guarded in one go.
Changing who can open a folder:
Every row on the Files tab has Edit Levels. Tick and untick, save, and access changes at once.
Nothing on the server is rewritten when you do that, because the guard file only carries the folder's id. Who may pass it is looked up live. If a guard file has gone missing, after a backup restore, an FTP tidy up, or another plugin, the row says so and Re-apply puts it back.
A folder for every new level:
Add a level and it is given a protected folder of its own, named after its slug, under the base folder set in Settings, which is files to begin with. Put the downloads in there and they are members only from the moment they land.
A folder of that name that already exists is never emptied or taken over. The new level is simply added to the list of who can open it. Levels that arrive through an import are left alone, so migrating thousands of members does not create thousands of folders. Turn the whole thing off in Settings if you organise your downloads another way.