Dprime Smart QR Share v2.4.0 Pro

A multi-tenant secure file sharing platform for WordPress. Companies upload files, generate tokenised download links with QR codes, and manage access — all without touching wp-admin.

Installation

Install and activate Dprime Core.
Download Dprime Smart QR Share from your account at my.dprime.au.
Install and activate it. It appears under Dprime → Smart QR Share.
Create the required WordPress pages (see Initial Setup), then go to Pages tab to link them.

Requires an active Dprime subscription. During the grace period the plugin keeps running with a notice. After the grace period company logins are paused but no data is lost.

Initial setup

The plugin needs three WordPress pages to handle registration, login, and the company dashboard. Optionally a fourth page for a frontend admin panel.

Create a page called Register. Add the shortcode [dp_sqs_register] to the content.
Create a page called Login. Add [dp_sqs_login].
Create a page called Dashboard. Add [dp_sqs_dashboard]. Keep this page private or protected — companies are redirected here after login.
Go to Dprime → Smart QR Share → Pages tab and select each page from the dropdowns.
Optionally create an Admin page with [dp_sqs_admin] and link it in the Pages tab. This gives you a frontend company and file management panel.

Companies

A company is a WordPress user with the dp_sqs_company role. They have no access to wp-admin — trying to open it redirects them to their dashboard.

Status

Status	Effect
Pending	Cannot log in. Account is waiting for admin approval. The admin receives an email when a new company signs up.
Active	Can log in, upload files, and manage their links. The company receives an email when first approved.
Disabled	Cannot log in. Data and files are preserved. Re-enable at any time.

Adding companies manually

Go to WordPress Users → Add New. Set the role to Company. The account is created as Active automatically. You can also edit company profile fields (company name, email, phone, website, address) from the standard WordPress user profile page.

Deleting a company

Deleting a company from the Companies tab also deletes all of its uploaded files from disk and removes all of its database records. This cannot be undone.

Files & links

Each uploaded file gets a unique 24-character hex token. The share URL is yoursite.com/[token]/. The token is the only way to access the file — there is no sequential ID or file path in the URL.

Access controls

Control	Behaviour
Password	Visitor must enter the correct password before the download starts. The hash is stored — the plain password is never saved.
Download limit	The file becomes unavailable once the download count reaches the maximum. The counter increments only on successful file stream completion.
Expiry date	The file becomes unavailable after the set date and time (UTC). The file is not deleted — only access is blocked.

QR code

Generated in the browser using the bundled qrcode library. No server call is needed. The company can download the QR code as SVG (vector, print-quality) or PNG (raster, web-ready). The QR code always encodes the share URL — not the short URL if one exists.

Anyone with the link can see the share page. It shows the file name, size, company name and logo, and any applicable restrictions. If the link is expired or download-limited, a clear error is shown — no file details are revealed.

Shortcodes

Shortcode	Renders	Who sees it
`[dp_sqs_register]`	Registration form (company name, email, password)	Public
`[dp_sqs_login]`	Login form. Pending/disabled accounts see a clear message.	Public
`[dp_sqs_dashboard]`	Company dashboard — file list, upload form, usage stats, profile editor, shortlink, QR generator	Logged-in company
`[dp_sqs_admin]`	Admin panel — company list, all files, platform stats, approve/disable/delete actions	WordPress admins only

All shortcodes output their own styles. You do not need to enqueue anything manually.

Short links

Connect a URL shortening service on the Short Link tab. Companies can shorten any share link from their dashboard with one click — useful for printing on physical documents where a 24-character token URL looks unwieldy.

Provider	Token required?	Notes
Bitly	Yes — an access token from bitly.com/settings/api	Supports custom domains if configured in Bitly
TinyURL	No	Uses the free public endpoint. Rate limits may apply at very high volumes.

Short URLs are stored per file. Shortening the same file a second time overwrites the previous short URL.

Security

Files outside web root. Uploads go to wp-content/uploads/dp-sqs-files/ with an .htaccess deny-all rule. Nginx users should add a location block to block direct access to this folder.
Tokens are cryptographically random. Generated with random_bytes(16), hex-encoded, 24 characters. Never sequential, never reused.
Upload validation. Files are checked against both extension allowlist and PHP finfo MIME type detection. A file renamed to .jpg with PHP content is rejected.
SVG sanitisation. Company logos uploaded as SVG are processed by the enshrined svg-sanitize library before storage. Javascript and external references are stripped.
Password hashing. Uses wp_hash_password (bcrypt). Plain-text passwords are never stored or logged.
Company isolation. Every database query that reads or writes file records is scoped to company_id. A company cannot access another company's files even if they know the token, because the dashboard only renders tokens belonging to their own account.
No wp-admin. Company users are redirected to their dashboard the moment WordPress detects they are in the admin area.
Download nonces. The download form includes a WP nonce. A direct POST to the download endpoint without a valid nonce is rejected.

FAQ

Can I customise the share page design?

The share page template is at includes/views/share-page.php. You can copy it to a child theme and override it using the standard WordPress template loading hierarchy, or simply edit the included CSS in assets/css/share.css.

Where are uploaded files stored?

In wp-content/uploads/dp-sqs-files/[user_id]/[filename]. The folder is protected by an .htaccess deny-all rule created on activation. Files are never served directly — all downloads go through the PHP stream function.

What happens to files when a company is deleted?

All of the company's files are deleted from disk and the database records are removed. This includes the physical files, not just the database rows. The operation is irreversible.

Can I set a global file size limit?

The upload limit is controlled by PHP (upload_max_filesize and post_max_size) and WordPress's wp_max_upload_size(). You can also set a per-company limit by extending the plugin via the dp_sqs_max_upload_size filter (see developer notes).

Does this work on Nginx?

Yes, but you need to add a server-level rule to block direct access to the upload folder, since .htaccess files are not processed by Nginx. Add a location block in your Nginx config: location ~* /uploads/dp-sqs-files/ { deny all; }

Can companies have sub-accounts or teams?

Not in the current version. Each registered email is one company account. Multiple users from the same company would need separate accounts.