Securing digital downloads in WooCommerce

Do you sell an e-book, a pdf, music or software through WooCommerce? Then you want only paying customers to be able to retrieve the file. WooCommerce handles that with a secure download link, but that only works properly if the download method is secure and the folder with files is locked down. Here you can read how it works, what you set up and how you check that a direct link doesn't work.

How a download in WooCommerce works

For a product, tick Downloadable and upload the file. WooCommerce places it in the folder wp-content/uploads/woocommerce_uploads/. By default, it appends a random string of characters behind the file name, so the name is hard to guess. The customer never gets that address, but a link to your shop. With every click, WooCommerce checks whether the download belongs to a paid order and whether the limit and expiry date have not yet been reached. Only then does the customer get the file.

If nothing is shipped with the order, also tick Virtual. Then WooCommerce doesn't charge shipping costs.

Choose a secure download method

Go to WooCommerce > Settings > Products > Downloadable products and check the download method (File download method):

Choose Force downloads, unless you're sure that X-Sendfile works. Also leave off the option that lets WooCommerce fall back to redirecting as a last resort.

The woocommerce_uploads folder must be locked down

With a secure method, the folder itself must be locked down for regular visitors. Otherwise, someone who knows the file name, for example from a leaked link, can retrieve the file directly. That's why WooCommerce places two files in the folder during installation:

• an empty index.html, so no list of files is shown;
• a .htaccess with the rule deny from all, which refuses all direct requests.

Such an .htaccess file works on web servers that read it, such as Apache and LiteSpeed. Our servers run on LiteSpeed, so with WebOké this protection works without extra settings. On a server with nginx, the web server doesn't read .htaccess; a rule in the server configuration is needed there. If you move your shop to such a server later, check this again.

The .htaccess file is hidden. To see whether it's there, see Showing and editing hidden files such as .htaccess. Don't delete it.

Checking that a direct link doesn't work

1. For a downloadable product, open the file address as WooCommerce shows it. It starts with /wp-content/uploads/woocommerce_uploads/.
2. Open that address in a private window, in which you are not logged in.
3. A good outcome is an error message 403 Forbidden (or 401 or 404). If you simply get to see or download the file, the folder is open.

Always test an actual file, not just the folder. A blank page at the folder could be the empty index.html, while the files themselves are indeed open. On the command line, it also works: curl -I https://example.com/wp-content/uploads/woocommerce_uploads/file.pdf should give a 403. You can read what a 403 means in Forbidden (403): You don't have permission to access / on this server.

Limits and access

• Download limit and expiry date are set per product or variation. Empty means unlimited. A strict limit reduces sharing, but causes complaints when someone buys a new computer.
• Access after payment is on by default: the customer can download as soon as the payment succeeds.
• Approved download directories: only files from these folders or these addresses may serve as a download. Keep the list short.

If you sell digital content to consumers, also arrange how the right of withdrawal works for downloads. WooCommerce doesn't handle that automatically. This article is not legal advice; check with the ACM or ask a lawyer.

Further reading

• Digital and downloadable product handling (WooCommerce, English)
• Free WordPress course, lesson 7.4 Hardening the site: permissions, headers and security plugins