Product Attachments for WooCommerce
Attach manuals and spec sheets to your products, kept in a protected folder and handed over only after a permission check.
What it does
Attach manuals and spec sheets to your products, kept in a protected folder and handed over only after a permission check.
Product Attachments lets you upload files on a product's own edit screen and show them on the product page as a list of download links. Each file is kept in a protected folder of its own, not in the media library, and every download goes through a check that asks whether this visitor may have it, so a file's address alone gets nobody in. Choose who may download each file: everyone, logged-in customers, or people who bought the product. Files are checked by their contents, not only their names, and a download count is kept without storing who downloaded.
Pro adds role and category rules, bulk access changes, share links with an end time and a use limit, purchase-based expiry, files attached to the order email, and a download report. Protection depends on your web server: Apache and IIS obey the deny rules written into the folder, nginx needs one line of server configuration, and a check on the settings screen tells you which you have. If the licence lapses nothing is deleted and every access setting keeps being enforced; share links, email attachments and the report stop until you renew.
See it in action
What the plugin does
- Files uploaded from the product's own edit screen, each with a title you can change.
- Files kept in a protected folder of their own, not the media library, with a random name for the folder and for every file.
- Deny rules written for Apache and IIS, and a check on the settings screen that tells you whether your server obeys them.
- Every download goes through a permission check on every request, so a file's address alone gets nobody in.
- Files checked by their contents, so a renamed file is refused. This checks the file's shape; it is not a virus scan.
- Choose who may download each file: everyone, logged-in customers, or people who bought the product.
- A download count for each file, kept without storing who downloaded it.
- Show the files as a tab, below the product tabs, or only where you place them.
- A shortcode, [patwc_attachments], and a Product Attachments block for block themes.
- A My Account tab where customers find the files for products they bought.
- Settings import and export, to copy a configuration to another shop or keep a backup.
- Your files are kept when you delete the plugin, unless you choose to remove them.
- High-Performance Order Storage compatibility.
- Role and category rules: limit a file to the roles you choose, or to products in chosen categories.
- Rules only ever narrow who is let in. They never open a file its own access setting closed.
- Bulk access changes: set who may download every file, or every file in one category, in one step.
- Share links for a single file, each with its own end time and an optional limit on how many times it can be used.
- A link opens a short page with a Download button, and the use is counted when the button is pressed, so a mail scanner that opens links does not use one up.
- A share link can be revoked from the product at any time.
- Purchase-based expiry: a file stops being offered a set number of days after the customer bought it, set for the shop or for one product.
- Expiry counts from the customer's most recent paid order and applies to files set for people who bought the product. An expired file is hidden, not deleted.
- Order email attachments: chosen files are sent with the order completed or order processing email.
- Only files the customer is allowed to download are attached, and a file that would take the email over your size limit is left out.
- A download report listing each file with its downloads and the last download, and a CSV export.
- If the licence lapses nothing is deleted: your files stay, and every access setting, including rules and purchase-based expiry, keeps being enforced.
- When the licence lapses, share links, email attachments and the download report stop until you renew.
- A 14-day trial on a new install before the licence matters.
- Updates from your PluginCity account, kept coming by your licence key.
Pricing
Every Pro plan is the same plugin with every feature. The only difference is how many sites you can run it on.
Single site
One site, with a year of updates and support.
$49/year
Secure checkout. Cancel any time.
5 sites
Most popularUp to 5 sites, with a year of updates and support.
$99/year
Secure checkout. Cancel any time.
25 sites
Up to 25 sites, with a year of updates and support.
$199/year
Secure checkout. Cancel any time.
Need more than 25 sites? Get in touch about a custom licence.
Frequently asked questions
How are the files kept private?
Each file is stored under a random name in a folder of its own inside your uploads folder, not in the media library, and the folder's name carries a random part too. The folder has deny rules that Apache and IIS obey. The only route the plugin offers to a file is its download link, and that checks the visitor first.
Is a file safe from someone who has its address?
The folder's deny rules do the work on Apache and IIS. Some servers ignore them: nginx is the usual one, and it needs one line of server configuration. The Protection card on the settings screen fetches a test file from your browser and tells you what happened. If you can, set PATWC_PRIVATE_DIR in wp-config.php to a folder outside the web root.
Can I keep the files outside the public site altogether?
Yes. Define PATWC_PRIVATE_DIR in wp-config.php as the path of a folder outside your public web root and the plugin keeps its files there. Downloads still go through the same permission check. The Protection card then has no address to test, so keeping that folder out of the public tree is up to you.
Is this a virus scanner?
No. Files are checked by what is inside them, and one whose contents do not match its name is refused, but that is a check of the file's shape, not a scan for malware. Scripts and executables are never accepted, whatever the settings say.
Which file types are accepted?
PDF, Word, Excel and PowerPoint documents, CSV and text files, common images, ZIP archives, MP3 and MP4. You can switch types off under WooCommerce, Product Attachments, and the size limit is set there too, 25 MB by default.
Who can download a file?
Each file is set to everyone, to logged-in customers, or to people who bought the product. Someone has bought it when they are logged in and their order for the product has been paid. Guests who checked out without an account cannot be recognised, so a file limited to buyers is not offered to them.
Do rules replace the access setting on a file?
No. They sit on top of it, and a rule can only narrow who is let in. A file set for logged-in customers with a rule for one role is for logged-in customers who also have that role. If several rules apply to one product, the customer has to pass all of them. Shop managers who can edit the product are never locked out.
What does a bulk access change do?
It sets the access setting on every file, or on every file in one category, in one step. It changes the setting stored on each file, so it can open files as well as close them. It does not move, copy or delete any file.
Who can use a share link?
Anyone who has the address, until it ends or runs out of uses. The link works for whoever holds it, so send it only to someone you are happy to have the file. A link opens a short page with a Download button, and the use is counted when the button is pressed rather than when the page is opened, which keeps a mail scanner that opens links from using it up.
Can I cancel a share link?
Yes. You can revoke a link at any time from the file's row on the product's Attachments tab. Links are signed with a secret held on your site.
How does purchase-based expiry work?
A file stops being offered a set number of days after the customer bought the product. You set the days for the whole shop under Access rules, or for one product on its Attachments tab. It applies only to files set for people who bought the product, and only to logged-in customers, because a guest cannot be recognised as a buyer. An expired file is hidden, not deleted.
What happens to a file's expiry if the customer buys again?
The days count from the customer's most recent paid order for the product, so a new purchase starts a new period.
Which files go out with an order email?
Only files you tick on the product, and only if that customer is allowed to download them under the file's access setting and your rules. A file that would take the email over the size limit you set is left out, and the rest still go. Emails other than order completed or order processing never carry files.
What does the download count and report show?
Each file's count goes up each time the file starts to download, and repeat downloads are counted again. The report lists each file with the product it belongs to, its downloads and its last download, with a CSV export. It does not say who downloaded a file, and no address or browser is stored.
Where do the files appear on the product page?
By default in a tab called Downloads. You can show them below the product tabs instead, or only where you place them with the Product Attachments block or the shortcode. A product with no files shows nothing at all, not even an empty tab.
Does it work with block themes?
Yes. The default tab works in classic and block themes. Below the product tabs works in a classic theme and in a block theme whose product template uses the Product Details block. Any other template can use the block or the shortcode.
Can I show a product's files somewhere else?
Yes. Put [patwc_attachments] in any content, or add the Product Attachments block. On a product page it shows that product's files; anywhere else, name the product, for example [patwc_attachments product_id="123"].
Can a download be resumed?
No. Each download starts from the beginning, and files are sent by your server through PHP, so very large files on a host with a short time limit may be cut off. That is why the size limit starts at 25 MB.
What happens if I copy a product?
The copy starts with no files. A stored file belongs to the product it was uploaded to, and sharing one file between two products would mean deleting it from one broke the other.
What happens to my files if I delete the plugin?
They stay on your server, with their records, unless you tick Delete on uninstall under WooCommerce, Product Attachments first. Your settings are always removed. If you install the plugin again, the files are found where you left them.
Does it work with High-Performance Order Storage?
Yes. Orders are only looked at through WooCommerce's own functions, and nothing is written to orders.
What happens if I deactivate WooCommerce?
The plugin steps aside and shows a notice. It does not fatally error, and your files and settings are waiting when WooCommerce comes back.
Does it send any data out?
Your files, settings and download counts stay on your site. The licence check and the update check contact PluginCity, and send the licence key, the site address and the plugin version. Nothing else is sent.
How do I install it and what does it need?
Download the ZIP from your PluginCity account, then go to Plugins, Add New, Upload Plugin, choose the ZIP and click Install Now. If an earlier copy of the plugin is already installed, choose Replace current with uploaded: every file and setting you have is kept. It needs WordPress 6.7 or later, WooCommerce 10.0 or later with WooCommerce active, and PHP 8.1 or later. There is nothing else to install alongside it.
How do updates and the licence key work?
Paste your licence key under WooCommerce, Product Attachments, Licence. Updates then arrive on your Plugins screen like any other, and the key keeps the Pro screens working. A new install has 14 days before that starts to matter.
What happens if my licence lapses?
Nothing is deleted and nothing breaks. Your files stay where they are, every access setting you made keeps being enforced, including role and category rules and purchase-based expiry, and downloads are still counted. Share links stop working, order emails go without attachments, and the rules, bulk, email and report screens are hidden. Renewing switches it all back on exactly as you left it.
More plugins
Estimated Delivery Dates for WooCommerce
Tell customers when their order will arrive, and your team when it has to leave. Estimates on the product page, cart, checkout and emails.
Minimum Order for WooCommerce
Set a minimum spend or quantity before checkout, with clear messaging that tells customers exactly what to add.
Free Shipping Bar for WooCommerce
Show customers how close they are to free shipping, with a progress bar on the cart, at checkout and in the mini-cart.
Delivery Instructions for WooCommerce
Gives customers one clear box at checkout for delivery or shipping instructions, on the classic checkout and the Checkout block, and shows what they wrote on the order and in your emails.
Stock Alerts for WooCommerce
Lets customers leave their email address on a sold-out product or variation, and emails them when it can be bought again. A change in the stock number on its own sends nothing.
Product Expiry Dates for WooCommerce
Give a product a date it can no longer be sold after. It comes off sale when that date passes, and a basket still holding it cannot be checked out.