Upload Directory Protection

Nginx Hardening — Upload Directory Protection

WP E-Signature writes an .htaccess  file to the upload directory (wp-content/uploads/esign/ ) to block direct HTTP access. This works on Apache. On Nginx, .htaccess  files are ignored, and the configuration below must be applied at the server level by the site owner or host.

If your server is Nginx and this has not been configured, you will see an admin notice inside WordPress. The plugin cannot apply this automatically.

Why this matters

Uploaded signer files (images, PDFs) are stored with randomized filenames. Without the configuration below, those files are directly accessible at their URL to anyone who knows or obtains the path.

While the unauthenticated upload path was closed in v1.9.4.2, files legitimately uploaded by signers can still be exposed via URL leakage — through email notifications, referrer headers, or server logs.

Configuration

Option A — Deny all direct access (recommended)

Blocks all direct HTTP access to the upload directory. Files are served only through the plugin's authenticated PHP download handler.

location ^~ /wp-content/uploads/esign/ {
    deny all;
}

Add this block inside your server {}  block, before any catch-all PHP location.

Option B — Allow only specific file types

Use this if you need to permit some direct access (for example, embedded images in documents).

location ^~ /wp-content/uploads/esign/ {
    deny all;
    location ~* \.(jpg|jpeg|png|gif)$ {
        allow all;
    }
}

This still blocks .pdf  and any file type not explicitly listed.

Managed host instructions

Kinsta - Go to MyKinsta > Sites > Your Site > Tools > Nginx Configuration, and add Option A under Custom Nginx configuration. If that option isn't available, contact Kinsta support to add a custom rule.

WP Engine - Go to User Portal > Installs > Your Site > Nginx Config, and paste Option A into the custom rules area.

Cloudways - Go to Server Management > Security > Add Nginx rule, and add Option A.

GridPane / Forge / SpinupWP - Add the rule to your site's Nginx configuration file directly, or via the platform's custom Nginx rules panel.

Testing the configuration

After applying, run the following to confirm the block is active:

curl -I https://your-site.com/wp-content/uploads/esign/
# Expected: HTTP/1.1 403 Forbidden

If you get 200 OK  or a directory listing, the rule has not taken effect.