Welcome to the FAQ guide for Simple File Vault. This reference addresses common technical, workflow, and pre-sales questions about file security, client portal customization, performance optimization, and developer integrations.
Q1: How does Simple File Vault secure files differently from the default WordPress Media Library?
The WordPress Media Library stores files in the public /wp-content/uploads/ directory, exposing files to direct URL web access, hotlinking, and search engine indexing.
Simple File Vault isolates files in a dedicated /wp-content/uploads/safe-vault/ directory protected by server-level .htaccess rules (on Apache/LiteSpeed) and PHP middleware blockers. Files cannot be accessed via direct static URLs. Instead, downloads and inline previews are requested through temporary, cryptographically signed REST API tokens (HMAC-SHA256) that expire automatically.
Q2: Can clients preview files (PDFs, images, videos) without downloading them?
Yes! In Simple File Vault 1.1.0+, the Free Core plugin includes a built-in interactive Live Preview Modal Lightbox. Users can click the Open action to inspect documents (PDFs), images (jpg, png, webp, svg), and stream audio/video (mp4, webm, mp3, wav) directly inside the browser using secure inline tokens.
Q3: Can we capture metadata (Name, Email, and Notes) from uploaders?
Yes. You can prompt users for metadata when they upload files via the frontend uploader form:
- Enable metadata capture globally in the dashboard settings, or customize it per-page using Gutenberg block settings (
showUploaderName,showUploaderEmail,showUploaderComments). - Metadata is sanitized on the server, mapped to the file, and saved securely.
- Built-in integrations automatically capture uploader data from Gravity Forms, Fluent Forms, and Uncanny Automator.
Q4: Can I receive email or webhook notifications when a client uploads a file?
Yes. Simple File Vault v1.1.0 includes automated notification triggers:
- Admin & Client Email Notifications: Send instant HTML email alerts to the site administrator and/or the uploader upon successful file submissions.
- Webhook Integrations: Dispatch real-time JSON payloads directly to Slack, Discord, Microsoft Teams, or Zapier/Make.
Q5: Will listing thousands of client files slow down my server?
No. The plugin avoids heavy physical disk scans on every page view:
- File lists are cached in a database transient (
sfvlt_file_registry) for up to 12 hours. - In Simple File Vault Pro, instant AJAX search with Unicode normalization and server-side pagination ensure sub-second response times even with massive document libraries.
- Large downloads are streamed in 64KB chunks to eliminate PHP memory exhaustion.
Q6: Can files be restricted so that users only see files they uploaded?
Yes. With Simple File Vault Pro, you can enable User Isolation Mode:
- Files are automatically associated with the uploader’s WordPress user ID.
- The frontend file registry filters the list so standard logged-in users only see their own files.
- Administrators and site managers retain full access to all client vaults.
- You can also enforce Role Restrictions (Limited Mode), User ID Group Access (Group Mode), or Access Key Gate (Restricted Mode).
Q7: How does the plugin prevent directory traversal and Remote Code Execution (RCE)?
The plugin employs a strict multi-stage validation pipeline:
- Directory Traversal Protection: Every file path is normalized and validated by
sfvlt_validate_safe_path(), rejecting..traversal sequences and ensuring realpath resolution never escapes the designated vault root boundary. - Double Extension Blocker: Regex scanner rejects executable double extensions (such as
.php.png,.phtml,.sh,.exe). - MIME Mapping: PHP fileinfo extension (
wp_check_filetype_and_ext()) verifies that the file extension strictly matches its internal binary MIME header. - Script Scans: Non-binary files (like CSV and text files) are scanned for PHP injection tags.
Q8: Does Simple File Vault support subfolders and bulk file operations?
Yes, in Simple File Vault Pro:
- Organize documents into unlimited hierarchical subdirectories.
- Select multiple files for one-click bulk deletion or packaging into a downloadable ZIP archive.
- Generate expiring email share links to send time-limited download URLs directly to external parties.