Image Protection

Sunshine Photo Cart includes multiple layers of protection to help prevent unauthorized downloading, sharing, and theft of your photos. These range from browser-level deterrents to server-level file security and gallery access controls.

No single method is 100% foolproof — a determined person can always find ways around digital protections. But combined, these features create strong barriers that stop the vast majority of casual image theft.

Right-Click and Drag Protection

This disables the right-click context menu and prevents drag-and-drop saving of images on all Sunshine pages. It also blocks the long-press save option on mobile devices.

How to Set It Up

1. Go to Sunshine > Settings > Display
2. Check Image Theft Prevention
3. Save your settings

How It Works

When enabled, visitors cannot right-click on images to "Save As" or drag images to their desktop. On mobile, the long-press save prompt is also blocked.

This protection only applies on your Sunshine gallery pages and does not affect admin users — you can still right-click and save images while logged in as an administrator.

Notes

• This is a browser-level deterrent. It stops most casual visitors but is not a technical barrier — someone who views page source or uses browser developer tools could still find image URLs.
• Best used alongside other protections like watermarks and secure file names.

Secure File Names

When images are uploaded, Sunshine automatically appends a long random string to each filename. This makes it virtually impossible for anyone to guess the direct URL to your image files.

How to Set It Up

This is enabled by default. To verify or change the setting:

1. Go to Sunshine > Settings > Display
2. Look for Use Secure File Names
3. Save your settings

How It Works

When you upload family-portrait.jpg, Sunshine renames it to something like family-portrait-aBcDeFgHiJkLmNoPqRsTuVwX.jpg. Each image size (thumbnail, large, etc.) gets its own unique random string.

The original filename is preserved internally for display purposes, but the actual file on your server has the randomized name. This prevents someone from guessing image URLs by trying common filenames.

Notes

• This is enabled by default and recommended for all sites.
• The random string is 24 characters long, making brute-force URL guessing impractical.
• If you turn this on after uploading images, only newly uploaded images will get secure names. Use the Regenerate Images tool under Sunshine > Tools to apply secure names to existing images.

Hotlink Protection

Sunshine automatically creates server rules that prevent other websites from embedding or linking directly to your full-size images.

How It Works

Sunshine places an .htaccess file in your uploads directory (/wp-content/uploads/sunshine/) that blocks image requests coming from external websites. Only requests from your own domain are allowed to load full-size images.

This protection is automatic — there is no setting to enable or disable it. Sunshine regenerates the rules daily and also updates them whenever the plugin is updated, so they stay current even if your domain changes (e.g., moving from a staging site to your live domain).

Notes

• This only works on Apache-based servers (the most common type for WordPress hosting). If your host uses Nginx, this particular protection won't apply — but the other layers still protect your images.
• Thumbnail and intermediate-sized images are allowed through without referrer checking, since these are lower resolution and often needed for things like social media previews.
• If you migrate your site to a new domain, the rules update automatically within 24 hours.

Watermarks

Sunshine can automatically apply a watermark to your gallery images during upload, adding a visible layer of branding and theft deterrence.

How to Set It Up

1. Go to Sunshine > Settings > Image
2. Upload a watermark image (PNG with transparency recommended)
3. Choose a position (center, corners, or repeat/tiled)
4. Optionally adjust the margin, max size, and whether to watermark thumbnails
5. Save your settings

How It Works

When you upload images to a gallery, Sunshine applies your watermark to the display-size version of each image. The original full-size file is preserved separately. You can choose to enable or disable watermarking per upload when adding images to a gallery.

If you change your watermark settings after uploading images, use the Regenerate Images tool under Sunshine > Tools to re-apply the new watermark to existing images.

Notes

• Use a PNG file with a transparent background for best results.
• The "repeat" position tiles the watermark across the entire image, making it especially difficult to crop out.
• Watermarking happens during image processing, so there may be a brief delay if you have background image processing enabled.

Gallery Password Protection

Individual galleries can be locked behind a password, requiring visitors to enter the correct password before viewing any images.

How to Set It Up

1. Edit a gallery in Sunshine > Galleries
2. In the gallery settings, set the access type to Password
3. Enter your chosen password and an optional hint
4. Save the gallery

How It Works

When a visitor navigates to a password-protected gallery, they see a password form instead of the images. After entering the correct password, it's stored in their session so they don't need to re-enter it during that visit.

Administrators always bypass the password requirement while logged in.

Private Galleries

Galleries can be restricted to specific WordPress users, requiring them to log in with an authorized account.

How to Set It Up

1. Edit a gallery in Sunshine > Galleries
2. Set the access type to Private
3. Select which users are allowed to view the gallery
4. Save the gallery

How It Works

Private galleries are only visible to the specific users you've selected. Anyone else who navigates to the gallery URL is redirected to the login page. Even after logging in, they can only view the gallery if their account is on the allowed list.

Email-Required Galleries

Galleries can require visitors to provide their email address before viewing images.

How to Set It Up

1. Edit a gallery in Sunshine > Galleries
2. Set the access type to Email
3. Optionally pre-populate the list of allowed email addresses
4. Save the gallery

How It Works

Visitors must enter their email address before the gallery images are shown. The email is stored in their session for the duration of their visit. This gives you a record of who viewed the gallery and can be combined with email marketing add-ons.

Account-Required Galleries

Galleries can require visitors to have a registered account and be logged in before viewing.

How to Set It Up

1. Edit a gallery in Sunshine > Galleries
2. Set the access type to Account
3. Save the gallery

How It Works

Any visitor who isn't logged in is redirected to the login or registration page. Once logged in, they can view the gallery. This is useful when you want to know exactly who is viewing your images.

Gallery Expiration

Galleries can be set to automatically expire after a certain date, cutting off access to the images.

How to Set It Up

1. Edit a gallery in Sunshine > Galleries
2. Set an expiration date
3. Save the gallery

How It Works

After the expiration date passes, the gallery is no longer accessible to visitors. An expiration notice can be displayed to visitors while the gallery is still active, letting them know the deadline. Administrators can always access expired galleries.

Putting It All Together

For maximum protection, use multiple layers together:

1. Enable secure file names (on by default) so URLs can't be guessed
2. Enable right-click protection to deter casual saving
3. Add a watermark so even if someone does save an image, it's branded
4. Hotlink protection runs automatically to block external sites from embedding your images
5. Use gallery access controls (password, private, or account-required) to limit who can even see the images in the first place