RayEtun Media Protection – Watermark and File Access Control

🛡️ RayEtun Media Protection is a media and document security suite for WordPress.

RayEtun Media Protection combines image watermarking, PDF watermarking, encrypted file delivery, expiring download links, role-based access control, editor blocks for protected galleries and downloads, and e-commerce integrations in a single plugin. Every feature listed below is included and works out of the box.

Use it to watermark product photos so they stay branded when shared, stamp PDFs with each buyer’s name and order number for traceable delivery, gate downloadable files behind login or role rules, and make download links expire after a set time or click count.

It is built the modern WordPress way — on the REST API, the block editor, @wordpress/components, and standard WordPress hooks. There is no jQuery on visitor pages and no external framework runtime.

How RayEtun Media Protection is organized

• Clearly labeled — every feature description says what it does and what it does not do. Deterrent scripts are labeled as deterrents in the settings, next to a note that no browser-side script can prevent a determined user from copying media.
• Local first — files, watermark rules, download logs, and settings live in your own WordPress database and file system.
• Built on WordPress APIs — the REST API, the block editor, @wordpress/components, and standard hooks. No jQuery on visitor pages, no framework runtime.
• Accessible — every admin screen is designed to WCAG 2.2 Level AA: keyboard operable, screen-reader labeled, focus managed, and reduced-motion aware.

🖼️ Image Watermarking

• 🎨 Text or image watermarks applied on upload, in bulk, or on demand from the media library.
• 🧭 Nine-position anchoring with pixel or percentage offsets — put the mark exactly where you want it.
• 🌗 Opacity and rotation controls; separate settings for portrait and landscape sources.
• 🔁 Non-destructive — originals are backed up before watermarking, so you can restore or re-watermark at any time.
• 🖼️ Preserves EXIF and IPTC metadata — camera data, copyright fields, and captions survive the watermark pass.
• ⚡ Dual engines — Imagick when the server has it, GD as a fallback.
• 📐 Small-image threshold — automatically skip files under a size you set (thumbnails, icons).
• 🌐 JPEG, PNG, and WebP all supported.

📄 PDF Watermarking

• 📝 Text or image watermarks on every page of any PDF you upload or serve as a download.
• 🧑 Dynamic per-user watermarks — insert the buyer’s email, IP, user ID, order number, download timestamp, or the site domain into the watermark itself. This makes each downloaded copy uniquely identifiable to the person who downloaded it.
• 🎯 Per-file rules — different watermark settings for different products, folders, or categories.
• 🔐 Password protection — set an open-password on the watermarked PDF, generated per download or shared.

🔒 Protected File Storage

• 🚪 Files stored outside the webroot when the server allows it, with an .htaccess fallback that blocks direct URL access on shared hosts.
• 🎫 Signed serve URLs — the only way to reach a protected file is through a validated request with a signed token.
• 👥 Role and user gating — restrict a file to logged-in users, specific roles, or specific accounts.
• ⏱️ Expiring links — expire by time (minutes to days) or by click count (single-use or fixed number of downloads).
• 🚫 Hotlink prevention — reject requests whose referrer does not belong to your site.
• 🤖 Auto-protect on upload — every new file uploaded to the media library can be protected automatically by an active rule.

🛒 E-Commerce Integrations

Works with the three most common WordPress download-selling plugins, out of the box:

• 🛒 WooCommerce — watermark and protect downloadable products; each buyer receives a PDF stamped with their name and order.
• 💾 Easy Digital Downloads — the same treatment for EDD downloads, using the customer’s email and receipt.
• 📦 Download Monitor — protected serving and per-download watermarking for Download Monitor libraries.

🧱 Gutenberg Blocks

Three editor blocks bring watermarking and access control straight into the block editor — no shortcodes to remember:

• 🖼️ Protected Gallery — show a photo grid with clean thumbnails. Clicking a photo opens a lightbox with the watermarked preview, and an authorized viewer downloads the clean original from a single button. Right-click is disabled on the images, and anyone who grabs the preview through a browser extension only ends up with the watermarked copy. Optional filter chips let visitors narrow the grid by tag.
• ⬇️ Protected Download — a single download card for a file of any type, with a matching file icon, an access rule, and a sign-in button for logged-out visitors. Two layout templates: a horizontal row card or a centered tile.
• 📚 Protected File Library — a grid of protected downloads with a live filter box, for delivering a set of files — a resource pack, a press kit, a set of lesson materials — behind one access rule.

Every block includes an accent-color picker, handles any file type (images, PDFs, audio, video, archives, documents) with a fitting icon, and offers a who can download choice of Everyone, logged-in users, or a named access rule. You can set defaults for each block once under RayEtun Media Protection → Blocks and reuse them everywhere.

🖱️ Deterrent Layer

An optional set of client-side deterrents you can enable per rule set. They are labeled in the settings for exactly what they are:

• 🚫 Right-click block — a casual deterrent. Does not prevent copying by a determined user.
• 🎯 Drag-and-drop disable — a casual deterrent that prevents accidental image drags.
• 🔧 DevTools open detection — a cosmetic deterrent that will not stop anyone who disables JavaScript.

Deterrents are off by default and can be enabled per rule set.

📊 Analytics

• 📉 Download attempts and blocks — see which files are requested most often, and which access rules fire.
• 🔥 Attempt heatmap — spot unusual bursts of traffic on a single file.
• 🔍 Per-file activity — every access decision is logged with the event, timestamp, and a hashed client fingerprint.
• 🔐 Privacy-respecting — IPs and user-agent strings are stored as salted hashes, never in the clear. Log entries older than 90 days are pruned automatically; the retention window is configurable.

🌐 Multisite

Full network compatibility. Enable per site, or activate network-wide and manage from the network admin.

🧭 What RayEtun Media Protection Will Not Do

Worth stating plainly, so you know what to expect:

• ❌ No “unbreakable” claims — no browser-side plugin can prevent a determined user from copying media. RayEtun Media Protection prevents casual copying, direct-URL access, unauthorized downloads, and unmarked resharing. The settings page states this alongside the deterrent controls.
• ❌ No overlay — RayEtun Media Protection changes markup and file bytes, not visitor UI.
• ❌ No data collection — no telemetry, no phone-home, no account. Everything is stored in your own WordPress database and file system.
• ❌ No breaking auto-updates — database schema migrations are versioned and idempotent.

Compatible With

• WooCommerce, Easy Digital Downloads, Download Monitor (built-in integrations)
• Block themes and classic themes
• Multisite networks
• Any hosting environment supporting the plugin minimums (PHP 8.0 or later, WordPress 6.7 or later); Imagick used when present, GD as a fallback

External Services

RayEtun Media Protection sends no data anywhere.

There is no telemetry, no analytics phone-home, no account, and no license check. Watermarking, file storage, access rules, and download logs are stored only in your own WordPress database and file system. There are no third-party API calls, no CDNs contacted, and no external fonts or assets loaded on your visitors’ pages.

Development

RayEtun Media Protection is open source and built with the official @wordpress/scripts toolchain (webpack). The complete, un-minified source — every module and admin screen — ships in the plugin’s src/ and src-ui/ directories; the files in build/ are compiled from them. Nothing is obfuscated.

To build from source:

composer install --no-dev && npm install && npm run build

That regenerates everything in build/. npm test runs the unit suite, and composer test runs the PHP tests. No build step is needed to use the plugin — the compiled output is included.

Bug reports are welcome in the support forum.

Credits

RayEtun Media Protection bundles the following open-source libraries; their copyright and license notices are preserved in vendor/:

• TCPDF by Nicola Asuni — LGPL-3.0-or-later — used for PDF watermarking output.
• FPDI by Setasign GmbH & Co. KG (free version) — MIT — used for reading existing PDFs before watermarking.

Everything else is original work under GPL-2.0-or-later.