At bluedrop.fr, we don't just use Drupal: we actively contribute to its ecosystem. For over 25 years, our team has been involved in the life of the open source community by developing, patching, and improving modules to meet the real needs of our clients and the community. Today, we present Deindex Unpublished Files, a recent module already embraced by the community, which solves a recurring security issue: public access to files linked to unpublished media.
Why is this module useful for your Drupal site?
As a Drupal agency, we regularly encounter situations where media files (images, PDFs, etc.) remain accessible via their direct URL, even after being disabled in the CMS.
Why? Because Drupal manages the publication status within the CMS, but the web server (Apache, Nginx) does not check this status: it serves the file if the URL is valid.
Result: sensitive or outdated content may be indexed by search engines or accessible to anyone who knows the URL.
Our commitment: concrete solutions for the community
We believe in open source as a lever for collective innovation. That's why we contribute to, test, and recommend modules such as Deindex Unpublished Files, which addresses this security flaw by:
- Blocking direct access to unpublished media files.
- Preventing their indexing by search engines.
- Offering two protection methods: URL prefix or moving to a private directory.
A young module, but already adopted: published on September 24, 2025, it is already in use on several sites, proof of its value to the community.
How does Deindex Unpublished Files work?
The Deindex Unpublished Files module for Drupal ensures that files associated with unpublished media entities are no longer publicly accessible.
Two methods are offered:
- Adding a prefix to the file URL (making the URL invalid or non-routable),
- Moving the file to a private file directory (for example private://unpublishedfiles) so it is managed through Drupal's private file system.
The module only works with media types that have a "file" type field.
In summary, this module adds a layer of protection at the file level (and their indexing), which complements the usual publication controls in Drupal.
Compatibility and installation: a module ready for Drupal 10 and 11
| Element | Detail |
|---|---|
| Compatible Drupal versions | 10 or 11 |
| Current stable version | 1.0.5 (released on September 26, 2025) |
| Development branches | 1.1.x-dev and 1.0.x-dev for testing |
| Recommended installation method | Via composer |
| Security coverage | Pending validation by drupal.org's security policy |
Installation and configuration
1. Installation via Composer
composer require 'drupal/deindex_unpublished_files:^1.0'Then enable the module via Drush or the interface:
drush en deindex_unpublished_files2. Configuration
- Clear the caches to apply the changes.
- Go to the configuration form: Configuration → Media → Unpublished files settings
- Choose your protection method:
- URL Prefix: ideal for a quick setup.
- Private files: recommended for maximum security.
3. Test file access
Test the direct URL of a file attached to an unpublished media item before and after activation. Before enabling the module, you will likely see that the URL provides access to the file. After activation, access should be blocked (404, access denied, or broken URL).
Use cases and benefits
Integration into a larger Drupal strategy
In the same spirit as the Page Cache Exclusion module that we have already introduced on this blog, the Deindex Unpublished Files module is part of a strategy to harden and control access.
Securing unpublished content
On an editorial, marketing, or institutional site, it can happen that intermediate documents, draft images, or test files are uploaded and then deactivated. Without this module, these files could remain accessible, leading to a data leak or exposure of unapproved content.
SEO optimization and GDPR compliance
By preventing unpublished files from being accessible, you reduce the risk of Google, Bing, or other search engines indexing them. This helps keep the site's index clean. The module therefore improves natural indexing (SEO) by avoiding duplicate or outdated content. It’s an advantage for French websites subject to the GDPR, where data management is critical.
Why trust us?
- Active contributors: We regularly participate in the Drupal community (patches, modules, events).
- Recognized expertise: 25 years of experience in developing and securing Drupal sites.
- Tailor-made approach: We adapt open source solutions to the specific needs of your projects.
Need help configuring Deindex Unpublished Files? Contact us for an audit or personalized support.
