Title: Private Files: Prevent cross-site lookup
Author: WordPress VIP Documentation
Published: February 11, 2021
Last modified: August 5, 2025

---

 1. [Changelog](https://docs.wpvip.com/changelog/)
 2. [VIP MU plugins [Production]](https://docs.wpvip.com/changelog/vip-mu-plugins-production/)
 3. Private Files: Prevent cross-site lookup

# Private Files: Prevent cross-site lookup

---

 11 February 2021

23:59:06 GMT+0000

 [ VIP MU plugins [Production] ](https://docs.wpvip.com/changelog/vip-mu-plugins-production/)

 [ Permalink  ](https://docs.wpvip.com/changelog/vip-mu-plugins-production/private-files-prevent-cross-site-lookup/)

In a multisite install, we support running mixed private and public sites. To harden
our ACL endpoint and prevent accidentally leaking private files via public sites,
we now restrict access to files on the same subsite.

[https://github.com/Automattic/vip-go-mu-plugins/pull/1975](https://github.com/Automattic/vip-go-mu-plugins/pull/1975)