First time setting up a digital purchases online and would like some pointers/tips on how to protect the directory where all the digital items are stored so someone can't access the file directly like: http://domain.com/some/digital/file.zip?

I'm using CartThrob, so I will either use the get_download_link or download_file_form tags which will handle link protection & obfuscation.

I just want to make sure I have all my ducks in a row. Thanks!


I have directory browsing turned off with .htaccess rules, so this fixes listing any files. I saw a couple solutions with adding rules to the directory, but wasn't sure if this would allow CT tags to access the file since I can't access it over the browser:

Order Deny, Allow
Deny from all

2 Answers 2


We keep all of our downloadable files above web root, so they're not directly accessible, similar to this setup:


And of course, we use Link Vault to obfuscate, protect against hot linking, and track the downloads.

  • 1
    Storing the files outside of web root, IMO, is the only reliable soliution. I believe CartThrob comes with its own tool to serve the files, but you may also consider separate file-serving add-ons, like Link Vault that Ryan has mentioned, or Protected Links Commented Feb 7, 2013 at 20:21

If you've obfuscated your links using CartThrob's tags, I typically just include a blank index.html file in any files/assets directories, as seems to be the EE convention. Then that's displayed instead of a directory index.

  • Mark, thanks for the input. I updated my question.
    – Siebird
    Commented Feb 7, 2013 at 16:58

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.