Into wp-content/uploads/trhc-attachments/, not your media library, so nothing a customer sends can turn up in a media picker or on a page by accident. Each one is stored under thirty-two random characters and no file extension, and is served by the plugin only after it has checked that you — or the customer whose request it is — are allowed to see that request.
The folder carries .htaccess and web.config files denying direct access. Apache and IIS obey those and nginx ignores them, so on nginx a file can be fetched by anyone who has its exact address, exactly as any media library upload can. Nothing publishes that address except the conversation itself. If that is not good enough for your site, deny the folder in your server configuration or switch the setting off.
Still stuck? Ask the developers who wrote it. We aim to reply within one business day.
Help Centre
A knowledge base, an FAQ and a support desk — so people find the answer, and reach you when they cannot.
From $19 a year · every feature · 30-day refund
