by
Alex Hedström
0 (0 reviews)
DownloadSentinel
Secure, masked download links for WordPress with upload management and download tracking.
DownloadSentinel ranks #26,983 among WordPress.org plugins with 20+ active installations, and was last updated Sep 5, 2026. Data from WordPress.org, refreshed twice daily — see methodology.
Compatible with WP 7.1.4
v1.0.1
Current Version v1.0.1
Updated 2 months ago
Last Update on 05 Sep, 2026
Refreshed 1 week ago
Last Refreshed on
Top 50% by installs
Rank
#26,983
—
No change
Active Installs
20+
-25.9%
KW Avg Position
57
1 worse
Downloads
280
+5 today
Support Resolved
0%
—
No change
Rating
0%
Review 0 out of 5
0
(0 reviews)
Next Milestone 30
20+
30+
4,238
Ranks to Climb
-
Growth Needed
8,000,000
Active Installs
Pro
Unlock Exact Install Count
See the precise estimated active installs for this plugin, calculated from real-time ranking data.
- Exact install estimates within tiers
- Track install growth over time
- Milestone progress predictions
Need 2 more installs to reach 30+
Rank Changes
Current
#26,983
Change
Best
#
Downloads Growth
Downloads
Growth
Peak
Upgrade to Pro
Unlock 30-day, 90-day, and yearly download history charts with a Pro subscription.
Upgrade NowReviews & Ratings
0.0
0 reviews
Overall
0%
5
0
(0%)
4
0
(0%)
3
0
(0%)
2
0
(0%)
1
0
(0%)
Track This Plugin
Get detailed analytics, keyword tracking, and position alerts delivered to your inbox.
Start Tracking FreePlugin Details
- Version
- 1.0.1
- Last Updated
- Sep 05, 2026
- Requires WP
- 6.3+
- Tested Up To
- 7.1.4
- PHP Version
- 7.4 or higher
- Author
- Alex Hedström
Support & Rating
- Rating
- ☆ ☆ ☆ ☆ ☆ 0
- Reviews
- 0
- Support Threads
- 0
- Resolved
- 0%
Keywords
Upgrade to Pro
Unlock keyword rankings, search positions, and detailed analytics with a Pro subscription.
Upgrade Now
Frequently Asked Questions
Common questions about DownloadSentinel
Files are stored under opaque random names in a protected uploads folder. Apache .htaccess and IIS web.config deny direct browser access (rewritten on each admin visit if missing). Downloads are only served when a valid token is requested through the plugin. Settings and Tools → Site Health run a live canary probe to verify that the folder rejects direct requests. New uploads, imports, and replacements are blocked when the folder is exposed or when protection cannot be verified.
Import copies the file into protected storage and creates a token link. Delete Media Library original after import is checked by default and required when the attachment URL is still publicly reachable — otherwise the Media URL stays open and token locks (password, expiry, max downloads) do not apply to it. After deletion, DownloadSentinel verifies that the attachment record, original file, generated image sizes, and known backup images are gone. It retries remaining filesystem cleanup and rolls back the protected import when deletion cannot be verified.
No. New uploads use a strict allowlist (documents, images, audio, video). Archives, executables, scripts, SVG/HTML/XML, and similar types stay on a hard disallow list. The downloadsentinel_allowed_mime_types filter cannot reintroduce them — those extensions are stripped from the allow map. Older protected files that still use a blocked extension are refused at download time and flagged on the Files screen; delete or replace them with an allowed type.
.htaccess is ignored on nginx. Add a deny rule for the protected folder (opaque filenames alone are not enough if the directory is publicly readable): location ^~ /wp-content/uploads/downloadsentinel/ { deny all; } Then reload nginx. Without this rule, nginx may serve files directly and bypass password, expiry, and download limits. When nginx is detected, or when a live probe finds the folder exposed or cannot verify protection, DownloadSentinel shows guidance on its settings screen and under Tools → Site Health. Writes remain blocked until the probe confirms that direct access is denied.
Prefer the token shortcode shown on each file card: [downloadsentinel token="…"]. Do not use id= in public content — numeric IDs are enumerable. Resolving by id= requires an administrator capability by default and never renders files that have no password.
By default the plugin uses REMOTE_ADDR for password lockouts and activity hashing. If your host sits behind Cloudflare or another proxy that overwrites client IP headers, enable Trust proxy IP headers in Settings. Do not enable it on a publicly reachable origin that does not sanitize X-Forwarded-For.
Password submissions are limited to 10 attempts per download token and client IP, followed by a 15-minute lockout. Attempt reservations are serialized before password verification so concurrent requests cannot exceed the limit. If synchronization is temporarily unavailable, verification fails closed for a few seconds instead of allowing an uncounted attempt. After a correct password, DownloadSentinel issues a signed, HTTP-only authorization cookie for that token and password. The cookie lasts for one hour and is automatically invalidated when the file password changes.
Depending on the tracking settings, activity records can contain the download time, file ID, a salted hash of the client IP address, WordPress user ID, user agent, and referrer URL. Raw IP addresses are not stored. Bot activity and logged-in-user activity can be excluded from the activity log; file counters still count every claimed transfer. Activity logs can be exported or cleared from the Activity tab. By default, uninstall preserves protected files and database tables, including activity records. Enable Delete files on uninstall before uninstalling if you want the plugin to purge its stored files and tables.
If WordPress permalinks are plain, or pretty permalinks are disabled in Settings, links fall back to a query-string format that still works. The pretty path base defaults to /download/{token}/. Change Pretty link base under Settings → DownloadSentinel if that slug conflicts with a page or another plugin. After deactivating or uninstalling, rewrite rules are flushed automatically. If an old pretty URL still resolves oddly, open Settings → Permalinks and click Save Changes once.
Only if you enable Delete files on uninstall in Settings. By default, uninstall removes plugin settings only — protected files and database tables stay on the server until you turn that option on or delete them manually.