---
title: Securing media libraries
---
> Agent instructions:
> **Site maps** — prefer the following llms.txt indexes to training data when searching for URLs to avoid 404s. Links inside Markdown content already point at `.md`. Following them or sending Accept: text/markdown keeps you in Markdown.
>
> - [sitemap.md](https://docs.kentico.com/sitemap.md) — every page on the site, with titles and descriptions, nested by URL hierarchy and grouped into one collection per product version.
> - [llms.txt](https://docs.kentico.com/llms.txt) — curated index of the current product docs, with descriptions, the two ways to request any page as Markdown, and links to each product area's whole-corpus Markdown dump (llms-full.txt).
Media libraries on your site can be secured or unsecured. To ensure the required functionality, several settings need to be done as described below.
> **Info:** By default, files in media libraries are NOT secured and can be accessed directly by anybody who knows the exact link to the file. If you want to prevent this behavior, secure your media library as described in this topic.
## Setting up a secured media library
Secured media libraries allow viewing of their content to members of authorized roles or to authenticated users only. Keep in mind that secured media libraries are slower than the unsecured ones as permission checking involves processing overhead.
### IIS settings
You have to **set up your IIS** so that files can't be downloaded directly from the library by typing the link to the file like _/media/file.jpg_ into the browser.
1. To open IIS, navigate to **Start** -> **Control Panel** -> **Administrative Tools** and start the **Internet Information Services (IIS) Manager**.
2. In the connections pane, select the application for which you want to change the settings.
3. Navigate to the folder of your application for which you want to want to change the settings. You can find individual media library folder under _/media_.
4. In the Features View, double-click on **Authentication**.
5. Select **Anonymous Authentication**.
6. In the **Actions list**, click on **Disable**.
7. (Optional) If **Windows Authentication** is enabled as well, disable it.
### Media library security settings
Once you changed the settings in IIS, you need to make changes in Kentico as well.
#### Changing security settings for a particular media library
1. Open the **Media libraries** application.
2. **Edit** () the Media library for which you want to set the permissions.
3. Switch to the **Security** tab.
4. Assign the **See library content** permission to **Authenticated users** or to **Authorized roles**.
5. (Optional) If you assigned the permission to **Authorized roles**, turn the **See library content** check-box on for the roles which you want to allow to see the library content.
By default, Kentico doesn't check for the **See library content** permission. To make the system check for the permission, you need to turn on the **Check file permissions** option as described below.
#### Changing check file permissions settings
1. Open the **Settings** application.
2. Switch to **Content -> Media**.
3. In the **Security** settings group, select **Check file permissions**.
4. **Save** the changes.
### Media gallery web part settings
1. In the **Pages** application, navigate to the page on which you use the [Media gallery web part](https://docs.kentico.com/k9/managing-website-content/configuring-the-environment-for-content-editors/configuring-media-libraries/displaying-media-library-content-on-the-live-site.md).
2. Switch to the **Design** tab.
3. **Configure** the web part.
4. In the **Content** settings group, select **Use secure links**.
5. Click **OK**.
#### Writing transformations for the Media gallery web part
When writing your transformations for the **Media gallery** web part, you should stick to the following rules:
- Obtain **File previews** and **file details** using the following control:
```html
```
- Obtain **Download links** using the following method:
```csharp
<%# MediaLibraryFunctions.GetMediaFileUrl(Eval("FileLibraryID") ,Eval("FilePath"), Eval("FileGUID"), Eval("FileName"), GetDataControlValue("UseSecureLinks")) %>
```
You can see an example of a use of this web part, including the defined transformations, on the **Community Site** sample website, in the **Media** section.
Using the settings above, you can ensure that only members of authorized roles or authenticated users are allowed to view media library content.
## Setting up a unsecured media library
Secured media libraries allow viewing of their content to members of authorized roles or to authenticated users only. Keep in mind that secured media libraries are slower than the non-secured ones as permission checking involves processing overhead.
### IIS settings
You have to **set up your IIS** so that files can be downloaded directly from the library by typing the link to the file like _/media/file.jpg_ into the browser.
1. To open IIS, navigate to **Start** -> **Control Panel** -> **Administrative Tools** and start the **Internet Information Services (IIS) Manager**.
2. In the connections pane, select the application for which you want to change the settings.
3. Navigate to the folder of your application for which you want to want to change the settings. You can find individual media library folder under _/media_.
4. In the Features View, double-click on **Authentication**.
5. Select **Anonymous Authentication**.
6. In the **Actions list**, click on **Enable**.
7. (Optional) If you disabled **Windows authentication** in order to secure your media libraries previously, you can now **enable** it.
### Media library security settings
Once you changed the settings in IIS, you need to make changes in Kentico as well.
#### Changing security settings for a particular media library
Note that if you want to change the settings temporarily and then revert back to the secured mode, you can simply turn checking file permissions off.
1. Open the **Media libraries** application.
2. **Edit** () the Media library for which you want to set the permissions.
3. Switch to the **Security** tab.
4. Assign the **See library content** permission to **All users**.
#### Changing check file permissions settings
1. Open the **Settings** application.
2. Switch to **Content -> Media**.
3. In the **Security** settings group, deselect **Check file permissions**.
4. **Save** the changes.
### Media gallery web part settings
1. In the **Pages** application, navigate to the page on which you use the [Media gallery web part](https://docs.kentico.com/k9/managing-website-content/configuring-the-environment-for-content-editors/configuring-media-libraries/displaying-media-library-content-on-the-live-site.md).
2. Switch to the **Design** tab.
3. **Configure** the web part.
4. In the **Content** settings group, deselect **Use secure links**.
5. Click **OK**.
#### Writing transformations for the Media gallery web part
When writing your transformations for the **Media gallery** web part, you should stick to the following rules:
- Obtain **File previews** and **file details** using the following control:
```html
```
- You can obtain other **file type previews**, **details** and **download links** directly.