Student files are stored in wp-content/uploads/nonprofit-lms/submissions/. The folder carries an .htaccess file that denies everything, which Apache honors. nginx and OpenLiteSpeed ignore it, so they need one rule.
nginx
Add this to the site’s configuration. On GridPane that’s the site’s nginx include files, or ask their support.
location ^~ /wp-content/uploads/nonprofit-lms/submissions/ { deny all; }
OpenLiteSpeed
Either add a static context for /wp-content/uploads/nonprofit-lms/submissions/ with Accessible set to No, or, with rewriting on, add this rule in the virtual host’s Rewrite tab:
RewriteRule ^/wp-content/uploads/nonprofit-lms/submissions/.*$ - [F,L]
Leave out the slash right after ^ if the rule goes in an .htaccess that OpenLiteSpeed loads. Then restart OpenLiteSpeed.
Checking it worked
The plugin checks whether the folder can be opened when it’s activated, and again at most once a day when a student uploads. While it can, an admin notice shows the nginx rule. Check again in the notice re-runs the check. The filter nonprofit_lms_submissions_hosting_check returning false turns the check off.
Until the rule is in, every file still has a random 24 character name, so its address can’t be guessed, and students only open files through the plugin’s own protected route.