<p>Since all <a href="http://buildwithcraft.com/docs/image-transforms" rel="nofollow">asset transforms</a> are saved in a sub-directory starting with an underscore, you could simply test for that.</p>

<blockquote>
  <p><strong>Original:</strong><br>
  /assets/folder/house.png</p>
  
  <p><strong>Transforms:</strong><br>
  /assets/folder/_900x500/house.png<br>
  /assets/folder/_thumb/house.png</p>
</blockquote>

<p><strong>Plugin:</strong></p>

<p>If your asset-folder is above <code>public_html</code>, and the request is routed through Craft, you could <a href="https://buildwithcraft.com/docs/plugins/introduction" rel="nofollow">create a plugin</a>, which checks for the underscore:</p>

<pre class="lang-php prettyprint-override"><code>public function init()
{
    parent::init();

    //Is resource request?
    if (craft()-&gt;request-&gt;isResourceRequest()) {

        //Parent directory
        $parent_dir = dirname(craft()-&gt;request-&gt;getUrl());

        //Check if parent dir doesn't beginns with an underscore
        if (!preg_match('/^[\/\\]*([_]+)/U', $parent_dir)) {
            exit(403);
        }
    }
}
</code></pre>

<p><strong>.htaccess:</strong></p>

<p>If your assets can be accessed directly, you'd have to use .htaccess to deny the request. I'm really bad at RewriteConditions, so this would possible be a question for <a href="http://stackoverflow.com">StackOverflow</a>.</p>

CC BY-SA 3.0
2014-08-04T13:26:08.637Z
2014-08-04T13:33:55.240Z
2014-08-04T13:33:55.240Z
Victor
<p>Is it possible to make the uploaded "original" images unaccessable for site visitors and make only the transforms public?</p>

<p>I'd like to upload images in full quality, to</p>

<ol>
<li>get the best possible quality out of Craft transforms</li>
<li>make Craft's assets folder basically a backup for my Lighroom library</li>
<li>no manual transforms necessary before upload (Craft does the job anyways for all the required 2x, 1x and thumbnail sizes)</li>
</ol>

<p>The images should be secure in that folder, otherwise I run into possible copyright problems (images would be in printable size and quality).</p>

<assets><url><image-transforms><security>
Make "original" images unaccessable?
# Make "original" images unaccessable?

(Asked by: username_0 on 2014-07-31)

Is it possible to make the uploaded "original" images unaccessable for site visitors and make only the transforms public?

I'd like to upload images in full quality, to

1. get the best possible quality out of Craft transforms
2. make Craft's assets folder basically a backup for my Lighroom library
3. no manual transforms necessary before upload (Craft does the job anyways for all the required 2x, 1x and thumbnail sizes)

The images should be secure in that folder, otherwise I run into possible copyright problems (images would be in printable size and quality).

**Tags:** assets, url, image-transforms, security

---

## 1 answers

### Answer by username_1 on 2014-08-04. Score: 2 | Accepted answer

Since all asset transforms are saved in a sub-directory starting with an underscore, you could simply test for that.

Original:
  /assets/folder/house.png
Transforms:
  /assets/folder/_900x500/house.png
  /assets/folder/_thumb/house.png

Plugin:
If your asset-folder is above public_html, and the request is routed through Craft, you could create a plugin, which checks for the underscore:
public function init()
{
    parent::init();

    //Is resource request?
    if (craft()->request->isResourceRequest()) {

        //Parent directory
        $parent_dir = dirname(craft()->request->getUrl());

        //Check if parent dir doesn't beginns with an underscore
        if (!preg_match('/^[\/\\]*([_]+)/U', $parent_dir)) {
            exit(403);
        }
    }
}

.htaccess:
If your assets can be accessed directly, you'd have to use .htaccess to deny the request. I'm really bad at RewriteConditions, so this would possible be a question for StackOverflow.


---

