Filevue

Filevue automatically creates a page at /client-portal/ with the login form when the plugin is activated. Clients visit that URL, enter their Client ID and password, and immediately see their files. You can also place the [filevue_client_files] shortcode on any page to create an alternative portal entry point.

On the Clients page, click the Portal button (the Filevue icon) next to any client. This generates a secure, single-use token that auto-logs you into the portal as that client in a new tab. The token expires after 60 seconds and can only be used once. No credentials are exposed.

No. Each client can only access files uploaded to their own folder. Downloads are verified against the logged-in client’s session.

PDF, XLSX, XLS, DOC, DOCX, TXT, PNG, JPG, JPEG, GIF, ZIP, and RAR. File size limits follow your WordPress and server configuration.

Yes. Go to Filevue > SMTP Settings, enter your credentials, and send a test email. Settings only activate after a successful test.

By default, all data is preserved, which is safe for updates and reinstalls. You can enable “Delete all data on uninstall” from the home page if you want a clean removal.

No. The portal uses your WordPress site name for all labels and headings. There is no hardcoded branding.

This error is returned by your hosting provider’s ModSecurity (a Web Application Firewall), not by Filevue itself. It’s a false positive where a legitimate request is being blocked because it matches a “suspicious” pattern.

Common triggers:

• Passwords containing special characters like %, ', ", <, >, =, or words like select, union, drop.
• Uploading files with unusual filenames (brackets, quotes, encoded characters).
• Filenames or folder names with accented / non-ASCII characters (very common in Spanish, French, Portuguese, German, etc. — e.g. Facturación.pdf, Año 2026.xlsx, Diseño.png, Niño.jpg). When the browser URL-encodes ó as %C3%B3, ModSecurity may block the request as a suspected encoding attack.
• Saving content that contains SQL-like words or HTML/JS snippets.

Good news: As of version 1.3.3, Filevue prevents most of these 406 errors automatically:

• Filenames are auto-transliterated at upload time while keeping spaces intact: Año 2026.pdf becomes Ano 2026.pdf (not Ano-2026.pdf), Facturación enero.pdf becomes Facturacion enero.pdf, Diseño final.png becomes Diseno final.png.
• Folder names follow the same rule: Diseño becomes Diseno, Año 2026 becomes Ano 2026.
• Client passwords can no longer contain characters that trigger ModSecurity: quotes (' "), angle brackets (< >), backslash (\), percent (%), semicolon (;), or accented / non-ASCII characters. Allowed characters are letters, numbers and - _ . ! @ # $ * + = : ? ~ ^ ( ) [ ] { } | ,. Existing passwords keep working; only newly-saved ones are validated.
• Client names, descriptions, and email messages are not affected — they fully support accented characters (á, é, í, ó, ú, ñ, ü, ¿, ¡), so you can still enter José García as a client name, write Spanish/French/Portuguese descriptions, and send localized emails. These fields are never sent through URLs, so WAFs can’t block them.

If you have existing files with accents on disk or old passwords with special characters and still hit the error, rename those files / reset the password to a safe one, or use one of the solutions below.

Solutions (in order of recommendation):

1. Contact your hosting provider and ask them to:
   • Check the ModSecurity logs for the blocked request.
   • Whitelist the triggered rule IDs for your site, or disable ModSecurity for /wp-admin/admin-ajax.php.
2. Try a different password for the client (use only letters, numbers, and -_.!@#) to confirm the password is the trigger.
3. Rename the file you are uploading to something simpler (letters, numbers, hyphens, underscores only).

4. Add a rule to your .htaccess (only if your host allows it) to bypass ModSecurity for AJAX:

   SecRuleEngine Off

This error is almost always a hosting configuration issue, not a plugin bug. Most shared hosts (Bluehost, SiteGround, HostGator, GoDaddy, etc.) ship with ModSecurity enabled and will gladly tune the rules if you contact support.