Darkstar Media Launches First Official WordPress Plugin: Darkstar File Manager

We are happy to announce that Darkstar Media has released its first official WordPress plugin, now available for download on WordPress.org — Darkstar File Manager.

It is an open-source project and we welcome other developers to contribute on our GitHub page.

The Problem We Solved

A few months back, we developed a custom WordPress plugin for managing files for WordPress users who need secure document sharing. The problem with WordPress’s default settings is that all files go into the uploads folder, and that folder is indexed by search engines. We identified a need for securely sharing files through WordPress while tapping into its existing functionality — secure logins and user management.

What the WordPress Plugin Does

Darkstar File Manager is a WordPress plugin for securely exchanging documents between administrators and clients. Files are served through an authenticated download handler — clients can only access their own files. You choose where files are stored, and we strongly recommend a directory outside the web root so they cannot be accessed directly via URL under any circumstances.

This plugin gives users the ability to store files in any folder, including below the website root. As long as you can identify the file path, we can store documents there.

Why Outside the Web Root?

Most WordPress file plugins store uploads inside wp-content/uploads/. Any file in that directory has a direct URL — if someone guesses or obtains the link, they can download it without logging in.

Darkstar File Manager lets you store files in any directory you choose. For maximum security, we recommend a path outside your web root (e.g. /var/www/client-docs instead of /var/www/html/wp-content/uploads). Files stored there have no direct URL — they can only be served through the plugin’s authenticated download handler, which verifies the user is logged in and owns the file before delivering it.

If you prefer, files can also be stored inside the web root (e.g. within wp-content). The authenticated handler still protects downloads, but a direct URL to the file would bypass that protection — so outside the web root is always the safer choice.

Features

• Configurable file storage path — store files anywhere; outside the web root recommended for maximum security
• Two-way file sharing — admins upload files for clients, clients upload files back
• Strict user isolation — each client can only access their own files
• Separate file sections — clients see “Documents for you” (from admin) and “Your Uploaded Documents” separately
• Simple shortcode — add [dsfm_client_login] to any page
• File type and MIME validation — configurable allowed types
• ZIP bomb protection — uncompressed content size limit enforced
• Upload rate limiting — 20 uploads per user per hour
• CSRF protection — nonce verification on all forms and downloads
• Protective .htaccess — automatically written to upload directory on activation
• Bulk delete — admins can delete multiple client files at once
• Translation ready — full i18n support with Polylang integration
• Responsive design — works on desktop, tablet, and mobile

We will continue to update the plugin as we identify issues and opportunities for expanded functionality. Please share it, let us know how you like it, and leave a review if you can!