So I'm trying to solve how to block users from downloading an attachment of a timed WordPress -post before article goes live? Attachments work as uploads on a custom field in an article.

My current solution is to use htaccess to block the uploads archive, so visitors cannot browse them and thus see a new file before its released. Also if the client gives a hard-to-guess names to the attachments then users will not be able to get to them without knowing the exact name (right?)

.htaccess:

Options -Indexes


My questions:


On a scale of 1-10, how easy my current solution is to hack? Is it possible to make this solution relatively safe
Is there another safer solution for this? could a plugin be developed to transfer the file from a safe place when article gets released
Can ANY solution where the attachment is on the server/inside WordPress -uploads be a safe solution?
Is there a third party solution for this? Like service that could release documents at specific time


Thank you very much in advance

Yes they are still vulnerable. Encryption just transforms a sequence of bits into another sequence of bits (and assuming the encryption is good it will be computationally infeasible to reverse this process without knowledge of some secret). There's no reason why encryption can't be performed again on an already encrypted sequence of bits.

It's possible certain ransomware implementations might look for specific files that are likely to be of high value, and encrypting these files might make them more difficult to recognise. However, I would not depend on this as my primary control against the threat of ransomware.
