How to Set Up File Access Controls in Easy Digital Downloads to Prevent Unauthorized Sharing

Selling digital files creates a problem physical products don’t have: once a customer shares a download link, your file can spread to anyone. A single purchase becomes thousands of free downloads. A license key gets posted on a forum. A course PDF appears on a torrent site 48 hours after launch.

Easy Digital Downloads ships with file access controls built in. Expiring links, download attempt limits, IP restrictions, hotlink protection – the tools are already there. Most store owners never configure them properly, leaving files exposed in ways they don’t realize. This guide covers every protection layer available in EDD, how each one works, and when to use which combination.

How EDD Protects Files by Default

Before adding any configuration, it helps to understand what EDD does automatically. When a customer completes a purchase, EDD does not hand them a direct URL to your file. Instead, it generates a signed download link that routes through WordPress. The file itself sits outside the web root – typically in wp-content/uploads/edd/ – and direct browser access returns a 403 error.

Every download request passes through EDD’s verification layer, which checks:

Is this a valid signed link?
Has the link expired?
Has the download limit been reached?
Does the customer’s purchase record exist?

This baseline protection stops casual link sharing. Someone who copies the download URL from their browser and shares it with a friend will find that the link either expires quickly or hits a download count limit. But baseline defaults are often too permissive for real-world use. Here is how to tighten each layer.

Download Link Expiration

By default, EDD generates links that expire after 24 hours. Most stores should shorten this significantly. A link that stays valid for 24 hours gives more than enough time for a customer to share it across forums or file-sharing sites before it expires.

Configuring Link Expiration

Go to Downloads → Settings → Misc → File Downloads. The Download Link Expiration field controls how long (in hours) a generated link remains valid after purchase.

Practical expiration windows by product type:

Product Type	Recommended Expiration	Reasoning
PDF documents, ebooks	6 hours	Customer downloads immediately; no need for long window
Software, plugins, themes	24 hours	May need to re-download after install failure
Large video files (>500 MB)	48 hours	Slow connections may need multiple attempts
Subscription / recurring access	N/A – use member area	Expiring links don’t suit ongoing access
High-value courses / bundles	12 hours	Short window; customer portal handles re-access

Setting expiration to 0 disables the expiration check – links never expire. Never use this setting for paid products. Reserve it only for free downloads where re-access is not a concern.

Letting Customers Re-Request Links

Short link expiration raises a legitimate concern: what if a customer needs to re-download a file after the link has expired? EDD handles this through the purchase confirmation email and the customer portal. Customers can log in to their account page and request new download links from their purchase history. Make sure Customer Accounts are enabled under Downloads → Settings → Misc → Accounts.

Download Attempt Limits

Link expiration and download limits work as a pair. Expiration controls the time window; limits control how many times the file can be downloaded within that window. A link that expires in 24 hours but allows 100 downloads is still easily exploited – the buyer downloads 100 copies and distributes them during that window.

Setting Per-Product Download Limits

Download limits are configured at the product level, not globally. When editing a Download post, look for Download Limit in the Download Files section. Enter the number of times this file may be downloaded per purchase. Enter 0 for unlimited.

Recommended limits by product type:

PDF, ebook, document: 3 downloads – enough for customer, not enough to share widely
Software / plugin: 5 downloads – accommodates multiple installs (dev + staging + production)
Large video file: 2 downloads – protects bandwidth; customer should keep the file
Free resource / lead magnet: Unlimited – no commercial risk

Resetting Download Limits for a Customer

When a customer legitimately needs more downloads – reinstalled their computer, lost the file – you can reset their count manually. Go to Downloads → Payment History, find the order, and click on it. In the File Downloads section, you can reset the download count or increase the limit for that specific purchase without affecting other customers.

Bundled Products and Limits

For bundles, EDD applies the download limit per file, not per bundle. If your bundle contains five files each with a limit of 3, the customer gets 3 downloads of each file – 15 total downloads across the bundle. Set limits accordingly when packaging multiple files together.

IP-Based Restrictions

IP restrictions add a layer of verification that links alone cannot provide. When enabled, EDD logs the IP address used for each download and can flag or block downloads from addresses that differ significantly from the purchase IP.

How EDD Records IP Data

Every download attempt is logged in the edd_logs table with the customer’s IP address, timestamp, post ID (the download), and payment ID. You can review this data under Downloads → Reports → File Downloads.

EDD does not enforce IP matching by default – it records but does not block. Strict IP enforcement is available through third-party extensions or custom code. The core data is there; enforcement is optional because legitimate customers often have dynamic IPs, download over mobile data, or use VPNs for privacy reasons.

When IP Restrictions Make Sense

IP-level blocking is most appropriate for:

High-value software licenses – Where the file is tied to a specific deployment environment
Abuse detection – Flagging downloads from many different IPs on a single purchase (clear sign of sharing)
Geographic access restrictions – Limiting downloads to specific countries for licensing or compliance reasons

For most digital product stores, per-purchase download limits combined with expiring links provide better protection with less friction than IP blocking. IP blocking frequently causes false positives – blocking legitimate customers who travel, use mobile data, or share a household with different devices.

Monitoring for IP-Based Abuse

Even without automatic blocking, you should review the file download logs regularly. Look for these red flags:

A single payment ID showing downloads from 10+ distinct IP addresses
Download timestamps spread across many days (original link should have expired)
Downloads from IP ranges associated with VPN exit nodes, Tor, or hosting providers (rather than residential ISPs)

When you identify abuse, go to the payment record and revoke access. Under the payment, set the status to Revoked – this invalidates all download links associated with that purchase.

Hotlink Protection

Hotlinking happens when someone embeds a direct URL to your file on their site or in a forum post, causing browsers to fetch the file directly from your server. This bypasses EDD’s download verification entirely if the file is publicly accessible. It also consumes your server bandwidth without any authentication check.

How EDD Prevents Direct File Access

EDD uses a custom rewrite rule to intercept requests to the uploads directory and route them through WordPress. Files stored in wp-content/uploads/edd/ cannot be accessed directly – any request returns a 403 unless it passes through EDD’s verification layer.

This protection depends on an .htaccess file (Apache) or a server block configuration (Nginx). EDD generates the Apache rules automatically. For Nginx, you need to add the configuration manually.

Verifying Apache Protection

Check that EDD’s rewrite rules are present in wp-content/uploads/edd/.htaccess. The file should contain rules that block direct access and route requests through WordPress. If this file is missing, run Downloads → Tools → System Info – EDD will attempt to regenerate it. You can also manually trigger regeneration by saving your EDD settings.

Nginx Configuration for File Protection

On Nginx servers, add this block to your server configuration to block direct access to EDD’s upload directory:

After adding the rule, reload Nginx and test by attempting to access a file URL directly in the browser. You should receive a 403 Forbidden response.

Testing Your Hotlink Protection

Copy the file URL from a download record in EDD and paste it directly into your browser’s address bar (without going through a purchase flow). If EDD is configured correctly, you will see a 403 error or be redirected to the shop page – not prompted to download the file.

Also test by right-clicking a download button in a completed checkout and copying the link. Paste that link in a private browsing window. A properly configured store should reject this request or show an expired link error.

Customer Download History

EDD maintains a complete download log: every file download, every customer, every IP, every timestamp. This data is your primary tool for investigating abuse, supporting customers, and auditing access patterns.

Accessing Download Logs

Go to Downloads → Reports → File Downloads. Filter by date range, product, or customer to see download activity. Each log entry shows:

Customer name and email
Product and specific file downloaded
Payment/order ID
IP address at time of download
Exact timestamp
Download count (how many times that purchase has downloaded that file)

Customer-Facing Download History

Customers can view their own purchase history and re-request download links from My Account → Purchase History. This page shows all orders with active download access, file names, and remaining download counts (if limits are set).

Enable the customer account area under Downloads → Settings → Misc → Accounts → Customer Accounts. This also gives customers the ability to update their billing information and manage email preferences – reducing support requests around re-downloads.

Querying Download History Programmatically

If you need to build custom reports or integrate download data with external systems, EDD exposes download log data through its functions. The code below retrieves recent downloads for a specific product:

Setting Data Retention for Logs

EDD stores download logs indefinitely by default. For stores with high download volumes, this table grows large over time. If you’re storing download log data for compliance purposes, note the retention requirements in your jurisdiction (EU GDPR typically requires you to delete logs when they’re no longer necessary). You can purge old logs via the EDD database tools or direct database queries – always back up before touching log tables.

File Protection Methods: Full Comparison

EDD offers several overlapping protection layers. Understanding which layer protects against which threat helps you choose the right combination for your store.

Protection Method	What It Stops	What It Doesn’t Stop	Setup Complexity	Customer Friction
Expiring links	Sharing links after purchase window; old links from re-shared emails	Sharing within the expiration window; actual file after download	None (built in)	Low (re-download via account)
Download count limits	Bulk downloading via the same link; distributing access credentials	File sharing after a single legitimate download	None (per-product setting)	Low (admin can reset)
IP logging/restrictions	Downloads from obviously different locations; mass distribution detection	Sharing among users in the same location; VPN usage	Medium (custom code or extension)	Medium (false positives possible)
Hotlink protection (.htaccess/Nginx)	Direct URL access without EDD authentication; bandwidth theft	Downloaded files being redistributed	Low (auto for Apache; manual for Nginx)	None
Software licensing	Unlimited license key sharing; using one key across many installs	File redistribution without the key	High (EDD Software Licensing extension)	Low (key activation flow)
Member area / gated content	Access after subscription cancellation; credential sharing	Screen recording / content copying	High (EDD Recurring + Restrict Content Pro)	Low (familiar login model)

No single protection method stops all unauthorized sharing. The goal is making casual sharing impractical – not achieving perfect security.

Recommended Configurations by Store Type

Rather than implementing every protection layer, pick the combination that matches your threat model and customer expectations.

PDF / Document Store

Link expiration: 6 hours
Download limit: 3 per purchase
Hotlink protection: Enabled (default for Apache)
IP restrictions: Not needed
Licensing: Not applicable

This combination stops link sharing effectively while giving customers enough downloads for their primary devices.

Software / Plugin / Theme Store

Link expiration: 24 hours
Download limit: 5 per purchase
Hotlink protection: Enabled
Software Licensing extension: Required – limits installs, enables updates, enables remote deactivation
IP restrictions: Optional – log only, alert on >5 unique IPs

The EDD Software Licensing extension is the key layer here. Expiring links protect the initial download; licensing controls ongoing use. Without it, customers who share the downloaded plugin file give recipients fully functional software with no license check.

Online Course / Video Content

Link expiration: 12 hours
Download limit: 2 per purchase for large files
Hotlink protection: Enabled
Member area: Strongly recommended – keep content streamed, not downloaded
EDD Recurring Payments: Required for subscription-based course access

Downloadable video files are impossible to protect once downloaded. If course content value depends on exclusivity, stream rather than download. Use EDD with Restrict Content Pro to gate streaming access behind active subscriptions.

High-Volume Low-Price Products (Templates, Assets)

Link expiration: 24 hours
Download limit: 5
Hotlink protection: Enabled
IP restrictions: Not needed
Licensing: Not applicable (price point too low to justify overhead)

At low price points, over-protecting creates more support tickets than revenue loss from sharing. Keep controls simple and focus on volume.

Advanced: Custom File Access Logic with EDD Hooks

EDD exposes hooks that let you add custom verification logic to the download process. You can use these to implement rules that aren’t available through the settings UI – such as blocking downloads during certain hours, requiring a customer to be logged in, or checking a custom field before allowing access.

The edd_process_download_headers action fires just before EDD serves a file. You can hook into it to run additional checks:

Be careful with hooks that exit or redirect – they need to fire before any output is sent. Add these in a site-specific plugin, not in a theme’s functions.php, so they persist through theme changes.

Frequently Asked Questions

What happens when a customer reaches their download limit?

EDD shows an error message stating the download limit has been reached and directs the customer to contact support. As the store owner, you can manually reset the count or increase the limit for that specific purchase from the payment record. Consider adding a note in your purchase confirmation email explaining how customers can request a reset – this reduces support tickets significantly.

Can I set different limits for different price variations on the same product?

Yes. EDD’s variable pricing (price IDs) allows different files per price tier. You can attach different files to each price option and set independent download limits per file. A “Standard” tier might get 3 downloads of the base file; a “Professional” tier gets 5 downloads of the same file plus 2 downloads of the bonus resources.

Should I use EDD’s built-in file hosting or a CDN?

EDD’s default setup serves files from your WordPress server. For large files or high download volumes, this creates performance issues and bandwidth costs. Amazon S3 (via the EDD Amazon S3 extension) is the standard solution – files are stored in S3, signed URLs are generated per download, and EDD’s access controls (limits, expiration) still apply. Signed S3 URLs expire even if someone copies the link, adding a second layer of expiration on top of EDD’s own.

Does EDD protect files from search engine indexing?

Yes. The .htaccess rules EDD creates prevent direct access to files in the EDD uploads directory, which also prevents search engines from indexing those URLs. However, if you’ve ever linked to a file directly (without going through EDD’s download system), those URLs may already be indexed. Check Search Console for any indexed URLs containing /wp-content/uploads/edd/ and submit removal requests if needed.

What’s the difference between revoking a payment and deleting it?

Revoking changes the payment status to “Revoked,” which invalidates all download access while preserving the payment record for accounting and audit purposes. Deleting removes the record entirely – you lose the data, the customer loses any reference to their purchase, and refund tracking becomes impossible. Always revoke rather than delete when terminating access for policy violations.

File Access Controls Audit Checklist

Use this list to verify your EDD store’s file protection configuration:

Link expiration is set – not 0 or 24+ hours for sensitive products
Download limits are set per product – not unlimited for paid files
Hotlink protection is active – test by accessing a file URL directly in browser
EDD uploads directory is protected – verify .htaccess exists and blocks direct access
Customer accounts are enabled – customers can re-request links without contacting support
Download logs are being reviewed – check for abuse patterns at least monthly
Software products use EDD Software Licensing – download protection alone is insufficient for software
High-value content uses signed cloud URLs – S3 or equivalent adds a second expiration layer
Nginx servers have manual rewrite rules – EDD’s Apache rules don’t apply automatically
Revocation workflow is documented – your team knows how to terminate access for violations

Next Steps

File access controls are the final piece of a complete EDD store configuration. With the right limits in place, you’ve closed the most common paths for unauthorized access without adding unnecessary friction for paying customers.

This is the sixth article in the EDD Store Setup & Configuration series. If you’re working through the full setup, you’ve now covered the complete stack: store setup, payment gateways, discount strategy, tax configuration, software licensing, and now file access controls.

If you’re selling software or plugins and haven’t set up EDD Software Licensing yet, that’s the highest-impact protection you can add. It takes file access beyond download limits into genuine usage enforcement – the difference between protecting the download and protecting the product itself.

Need help configuring EDD file access controls for your specific store setup? We specialize in custom EDD configurations for digital product stores. Get in touch and we’ll review your current setup and recommend the right combination of protections for your products.