Protecting against downloading via direct URL

In case it’s useful to anyone else, I’ve bodged a fix for this.
This will disable the plugin for any user who is not logged in, so if any logged in users try to share direct download links with non-logged in users, they will just get a white screen.

Create a new file called disable-logged-out-plugin.php with this code, and then upload it to the mu-plugins in your wp-content folder:

<?php
add_filter( ‘option_active_plugins’, ‘disable_logged_out_plugin’ );
function disable_logged_out_plugin( $plugins ) {
require (ABSPATH . WPINC . ‘/pluggable.php’);
if ( !is_user_logged_in() & !is_admin() ) {
$key = array_search( ‘download-attachments/download-attachments.php’ , $plugins );
if ( false !== $key ) {
unset( $plugins[ $key ] );
}
}
return $plugins;
}

If you use FTP to access your server, just navigate to the wp-content folder and create a new folder called mu-plugins if you don’t already have one there.