<p>You could create what I call a &quot;traffic controller&quot; template.</p>
<p>Route asset requests via the routes config to a template that checks whatever conditions you want, and then either returns a 503 Forbidden, a redirect to the proper login page, or calls the asset.</p>
<p>Do note - this is sucky for some performance reasons (you're adding an extra step and route to all of your asset calls)</p>
<p>This also isn't a great idea if your site is highly interested in image SEO (art gallery, e-commerce, photographer, etc.)</p>
<p>It's a quick and brute-force way to do it, but it's a way.</p>
<p>Also - if not already doing so, you can set up a robots.txt to NOT index specific image paths to prevent crawlers from finding them. SEOMatic has settings to omit them from the sitemap too. Best of luck!</p>

CC BY-SA 4.0
2023-11-20T21:45:19.883Z
How do you route "asset requests" specifically? I'm messing around with routes.php and as far as I can tell a url that matches a literal file location (eg https://mysite.com/uploads/myfile.jpeg) will get served even if I have a route for 'uploads/<filename>'.
Brimby
CC BY-SA 4.0
2023-03-02T04:32:45.687Z
2023-03-02T04:49:46.777Z
2023-03-02T04:49:46.777Z
cherrykoda
<p>We use a self-programmed &quot;secure assets&quot; plugin for this. It restricts access via the URLs to logged-in users. I will ask if and when we will make this available in the plugin store.</p>

CC BY-SA 4.0
2022-09-29T07:43:11.697Z
2022-09-29T07:43:11.697Z
M.Schmidt
<p>This will probably not be possible, but here goes nothing:</p>
<p>I have entries that are password protected using the <a href="https://plugins.craftcms.com/template-guard" rel="nofollow noreferrer">Template Guard</a> plugin. While this does work perfectly, this does only password protect the entry its self. Any assets uploaded to this entry are (obviously) still publicly accessible when using their asset URL. But as far as I know, all assets need a public URL to be able to upload them in the control panel and display them in templates.</p>
<p>Or is there any way to block public URL-access to these assets (maybe a specific volume)?</p>

<assets><url><password>
Is there a way to block access to assets by url?
# Is there a way to block access to assets by url?

(Asked by: username_0 on 2022-09-28)

This will probably not be possible, but here goes nothing:

I have entries that are password protected using the [Template Guard](https://plugins.craftcms.com/template-guard) plugin. While this does work perfectly, this does only password protect the entry its self. Any assets uploaded to this entry are (obviously) still publicly accessible when using their asset URL. But as far as I know, all assets need a public URL to be able to upload them in the control panel and display them in templates.

Or is there any way to block public URL-access to these assets (maybe a specific volume)?

**Tags:** assets, url, password


---

## 2 answers

### Answer by username_1 on 2023-03-02. Score: 3

You could create what I call a "traffic controller" template.

Route asset requests via the routes config to a template that checks whatever conditions you want, and then either returns a 503 Forbidden, a redirect to the proper login page, or calls the asset.

Do note - this is sucky for some performance reasons (you're adding an extra step and route to all of your asset calls)

This also isn't a great idea if your site is highly interested in image SEO (art gallery, e-commerce, photographer, etc.)

It's a quick and brute-force way to do it, but it's a way.

Also - if not already doing so, you can set up a robots.txt to NOT index specific image paths to prevent crawlers from finding them. SEOMatic has settings to omit them from the sitemap too. Best of luck!

> **Comments:**
> **username_2**: How do you route "asset requests" specifically? I'm messing around with routes.php and as far as I can tell a url that matches a literal file location (eg https://mysite.com/uploads/myfile.jpeg) will get served even if I have a route for 'uploads/<filename>'.  

---

### Answer by username_3 on 2022-09-29. Score: 1

We use a self-programmed "secure assets" plugin for this. It restricts access via the URLs to logged-in users. I will ask if and when we will make this available in the plugin store.


---

