DL-Manager 0.4.1

Secure WordPress Download Manager

Overview

DL-Manager is a lightweight WordPress download manager designed to provide secure public downloads without requiring visitors to log in. It stores downloadable files, README documentation, and optional screenshots in its own storage directory instead of depending on the WordPress Media Library.

Each download gets its own public WordPress page using the /dl/ URL structure. Download counts are tracked, and administrators can receive an email notification after a successful download.

What 0.4.1 Provides

• Secure public downloads.
• No visitor login required.
• Individual download pages using the /dl/ID/ URL structure.
• Public download list shortcode.
• Individual download shortcode.
• README HTML documentation displayed on the download page.
• Optional screenshots for each download.
• Download counters.
• Email notifications after successful downloads.
• Separate storage outside the WordPress Media Library.
• Display or hide individual downloads from the public download list.
• Delete uploaded download files.
• Delete uploaded README files.
• Delete uploaded screenshots.
• Automatic replacement of an older README or screenshot when a new one is uploaded.
• Support for replacing a download file without changing the download ID.
• Optional Cloudflare Turnstile bot protection for download requests.
• Direct download URLs are blocked when Turnstile protection is enabled unless the visitor passes the security check.
• Server-side Turnstile token validation using Cloudflare's Siteverify API.

Installation

1. Back up your WordPress website.
2. Go to Plugins → Add New Plugin → Upload Plugin.
3. Upload the DL-Manager ZIP file.
4. Install the plugin.
5. Activate DL-Manager.
6. Open DL-Manager → Settings.

When activated, DL-Manager automatically creates and verifies its required storage folders and refreshes the WordPress rewrite rules used by the /dl/ URLs.

Storage

DL-Manager uses its own storage folder:

wp-content/dl-manager-storage/

The storage contains three main folders:

The plugin also creates protection files in the storage directory and performs an actual PHP write test to verify that the required folders are writable.

DL-Manager Settings

Go to:

WordPress Dashboard → DL-Manager → Settings

The settings page provides:

• Download notification email — email address that receives a notification after a successful download.
• Create / Repair DL-Manager Storage — verifies or recreates the required storage folders.
• Storage status — reports whether the DL-Manager storage is available and writable.

The notification email defaults to the WordPress administrator email address.

Creating a Download

1. Go to DL-Manager → Add Download.
2. Enter the download title.
3. Enter an optional description.
4. Upload the download file.
5. Upload an optional README HTML file.
6. Upload an optional screenshot.
7. Choose whether the download should appear on the public downloads list.
8. Publish the download.

Supported Download File Types

DL-Manager 0.4.0 allows these download extensions:

zip, pdf, txt, doc, docx, xls, xlsx, csv, jpg, jpeg, png, gif, webp, json

README Files

Each download can have its own README HTML file. The README is displayed as documentation on the public download page.

The plugin removes scripts, forms, inline event handlers, JavaScript URLs, and styles from uploaded README content before displaying it. WordPress shortcodes inside a README are not executed.

Public Download Pages

Each published download uses the WordPress sdm_download post type with the rewrite slug:

/dl/

For example, download ID 727 would normally be available at:

/dl/727/

The exact URL is shown in the Download Details box when editing a download.

Individual Download Shortcode

To display one download inside a WordPress page or post, use:

[dl-manager id="727"]

Replace 727 with the ID of the download you want to display.

The plugin also supports these aliases:

[dl_manager id="727"]
[sdm_download id="727"]

Public Download List

To display a public list of downloads, use:

[dl-manager-list]

The list displays downloads that are marked for public display.

You can control the list with these attributes:

[dl-manager-list limit="10" orderby="date" order="DESC"]

Supported orderby values are:

• date
• title
• modified
• menu_order

The plugin also supports:

[dl_manager_list]

Display / Hide Downloads

Each download has a Display on public downloads page checkbox.

• Checked: The download appears in [dl-manager-list].
• Unchecked: The download is hidden from the public list.

Hiding a download from the list does not delete it. Its individual /dl/ID/ page remains available by direct URL.

Replacing Files

If you need to correct or replace an uploaded file, you can upload the replacement from the Download Details screen without creating a new download ID.

README and screenshot uploads replace the previous stored README or screenshot associated with that download.

Deleting Uploaded Files

The Download Details screen provides separate controls for deleting:

• Uploaded download file
• Uploaded README
• Uploaded screenshot

Deleting an uploaded file does not delete the download post itself.

Download Counts

Each successful download increases the download counter for that download. The current count is shown on the individual download page and in the public download list when a file is available.

Email Notifications

After a successful download, DL-Manager can send a notification to the configured administrator email address.

The notification includes information such as:

• Download name
• Version detected from the README
• Downloaded filename
• Date and time
• Visitor IP address
• Download page URL

Version Detection

DL-Manager attempts to detect a plugin version from the uploaded README by looking for a version number following the word Version.

For example:

Version: 1.2.3

If a matching version number is found, it can be displayed on the public download page and included in the download notification email.

Optional Cloudflare Turnstile Protection

DL-Manager 0.4.1 can optionally protect downloads with Cloudflare Turnstile. The feature is disabled by default, so existing installations continue to work normally until an administrator enables it.

To enable it:

1. Create a Turnstile widget in your Cloudflare dashboard for jonesboroweather.com.
2. Copy the Turnstile Site Key and Secret Key.
3. Go to DL-Manager → Settings.
4. Check Enable Turnstile protection for downloads.
5. Paste the Site Key and Secret Key into the corresponding fields.
6. Save the settings.

When enabled, the public download page displays the Turnstile security check before the Download button can submit the file request. DL-Manager also rejects direct GET requests to the download endpoint, so a bot cannot simply bypass the visible check by requesting the download URL directly.

Turnstile creates a verification token in the visitor's browser. DL-Manager sends that token to Cloudflare's server-side Siteverify endpoint before serving the file. Tokens are single-use and expire after five minutes, so a copied token cannot simply be replayed.

The Turnstile widget uses Cloudflare's standard implicit form integration, so DL-Manager does not generate HTML from JavaScript and does not require a custom JavaScript file for the security check.

Security

DL-Manager uses WordPress nonces for administrative actions and protected asset requests. Download files are stored outside the normal WordPress Media Library, and the download handler verifies that requested files remain inside the DL-Manager storage directory before serving them.

Troubleshooting

Storage problem

Go to DL-Manager → Settings and click Create / Repair DL-Manager Storage. The plugin verifies that the folders exist and that PHP can write to them.

Download page returns a 404

Go to Settings → Permalinks in WordPress and click Save Changes. This refreshes WordPress rewrite rules.

Download notification email is not received

Verify the email address under DL-Manager → Settings. Also verify that WordPress email delivery is working on your hosting account.

Download does not appear on the public list

Edit the download and make sure Display on public downloads page is checked.

Shortcode Quick Reference

License

DL-Manager is licensed under the GPLv2 or later.

Credits

DL-Manager is developed by John Martin.

DL-Manager 0.4.1 — README generated from the supplied plugin source.