Downloads and Delivery

After someone buys (or uses a free download with email capture), they need a reliable way to get the file. This guide explains how delivery works and what you can control.

Secure Delivery

Purchased files are not handed out as public media library links. Customers receive private download links that only work for authorized buyers.

You choose how each product stores its file in Product Details:

Uploaded file

The file is stored in a protected location managed by the plugin. After access is checked, the file is served through the plugin’s download handler.

External URL

The file lives on another server or service. After access is checked, the customer is redirected to that URL. Prefer https:// links.

Each product has one file or one external URL. Bundle multiple files into a ZIP before uploading if needed.

Keeping uploaded files private

For uploaded files, the plugin stores them under wp-content/uploads/aveniadp-protected/ and writes Apache .htaccess deny-all rules there. Authorized buyers still download through the plugin’s slickdp-download links; those go through WordPress and are not blocked by the folder rules.

On Apache, the .htaccess file is usually enough.

On Nginx (including hosts that put Nginx in front of Apache and serve static files through Nginx), .htaccess is ignored for direct file URLs. If someone can open a product file by guessing or copying a /wp-content/uploads/aveniadp-protected/… URL, the folder needs a rule at the server level. System Status → Protected uploads shows the exact snippet for your site, for example:

location ^~ /wp-content/uploads/aveniadp-protected/ {
deny all;
return 403;
}

The ^~ prefix matters: it makes this rule win over the general rules that serve zip, pdf, and image files directly.

Where the Nginx rule goes

The snippet is server configuration, not something you paste into WordPress. There is no plugin setting for it, and it does not go in .htaccess.

If you manage the server (VPS, dedicated, or a host that exposes Nginx config)
Add it inside the site’s server { } block, usually in a file like /etc/nginx/sites-available/yourdomain.conf or /etc/nginx/conf.d/yourdomain.conf. Put it alongside the other location blocks, then test and reload Nginx:

nginx -t
systemctl reload nginx

If you are on managed or shared hosting
You normally cannot edit Nginx config yourself. Two options:

1. Ask your host’s support to deny direct access to /wp-content/uploads/aveniadp-protected/ for your site. Most hosts will add this on request.
2. If your host has a “static file delivery” or “direct delivery” speed option that serves files through Nginx and bypasses Apache, turning that off for the site lets the plugin’s .htaccess rules apply again. This is the quickest fix, at a small performance cost for static files.

After changing server config or host settings, purge any page or CDN cache that may have stored the file, then re-check System Status. A private browser window should get 403 (or similar) for a direct file URL, while account and email download links still work.

Two Ways Customers Download

Email links

After purchase, the Download Link email includes a button or URL. Those emailed links expire after a number of days you set under Settings → Emails → Email Link Expiration (days). The default is 2 days (about 48 hours). Account downloads are not affected by this expiration.

My Account

Logged-in customers can re-download from My Account as many times as they need for as long as their purchase or subscription still grants access (and access has not been revoked). This is the path you should point people to when an email link has expired.

There is no download count limit. Access is controlled by order status, subscription status, and revoke actions, not by how many times the file was downloaded.

If Access Is Revoked

If you revoke an order or a customer’s access, download links stop working immediately. That is intentional for refunds and abuse cases.