Browser: Chrome 132.0.6834.83 / FF Dev 135.0b8 & more
OS: macOS
Setting a password to protect the entire site, exclude the homepage and also protect the media.
I can still access the media via url without seeing a password page. Not sure if the password protect is intended to protect direct URL access or not but not too sure what Media post type would be if not.
Same result with just trying to protect the media post type alone with its own template.
Hi @dan,
Thank you for reporting this! I was able to replicate the issue on my end. From what I can tell, this behavior appears to be consistent with how other password protection plugins handle media files.
That said, I’ve added this to our to-do list to explore how feasible it would be to protect media file access. If it’s not possible, we’ll consider removing it as an option from the conditions to avoid confusion.
Thanks @charaf .
There are plugins that protect the media flies by direct access so it is possible and can be done. Would be great if you can add it.
But either way, adding the functionality or removing the option would be good so we know where we stand 
