Which WooCommerce download methods expose a direct file URL?

Definition: A direct file URL is an address that a browser can request for the file itself. In WooCommerce, Redirect only exposes that URL; Force Downloads hides direct links behind a PHP download handler, while X-Accel-Redirect/X-Sendfile delegates delivery to the web server.

Key facts

• WooCommerce places the file delivery choice in WooCommerce > Settings > Products > Downloadable products, under the File Download Method setting (Products Settings documentation).
• Redirect only links the customer to the file and leaves the file unprotected from outside access, according to WooCommerce's settings documentation.
• Force Downloads uses a PHP script, and WooCommerce says that direct links are hidden.
• X-Accel-Redirect/X-Sendfile uses a supported web server module for delivery. The protection depends on server support and configuration (Digital/Downloadable Product Guide).

Where do you choose the download method?

The setting is on the downloadable products screen:

WooCommerce > Settings > Products > Downloadable products
File download method
Force Downloads
X-Accel-Redirect/X-Sendfile
Redirect only

WooCommerce describes this setting as controlling how the store provides downloadable files to purchasers. Its product settings page names the three choices, and the more detailed guide explains that each method handles file delivery differently. The selected method applies to the way WooCommerce serves downloadable product files, while access restriction settings are separate controls on the same screen.

Which choice exposes the file URL?

Redirect only is the method that exposes a direct file URL. WooCommerce's detailed guide says that customers are redirected directly to the file URL and that anyone with the URL can access the file, even without being logged in. The settings page describes the same method as a download URL that links the user to the file and says that files are not protected from outside access.

Force Downloads has the opposite documented behavior for direct linking. WooCommerce says that files are delivered using PHP, which prevents direct linking. The settings page describes the files as forced to download through a PHP script and says that direct links are hidden. A browser still receives the purchased file, but the documentation does not describe the file URL as the delivery address exposed to the customer.

How does server-assisted delivery differ?

X-Accel-Redirect/X-Sendfile is the server-assisted option. The web server handles file delivery directly to the customer, and the guide says that the relevant module must be installed and enabled. WooCommerce's settings page describes this method as similar to forced downloads and says that it can support larger files when the host supports X-Sendfile or X-Accel-Redirect.

The method name alone does not establish the protection of a particular site. WooCommerce states that protection depends on server support and configuration, and that NGINX requires explicit configuration. A site review therefore needs the selected method and the relevant web server configuration.

Can another setting expose a URL as a fallback?

The detailed guide documents an Allow using redirect mode (insecure) as a last resort setting for sites that select Force Downloads or X-Accel-Redirect/X-Sendfile. When enabled, WooCommerce can use the redirect method if a remotely hosted file cannot be delivered with the selected method. The guide says that this fallback carries the same risks as Redirect only, so a site using server-assisted delivery can still expose a file URL when this fallback is active.

The Open in browser setting concerns whether the file opens in the browser or is saved to the device by default. WooCommerce separately states that this setting does not work with redirects, so it does not change which download method exposes the file URL.

Related terms

• How do I hide a WooCommerce product from the catalog?
• How do I change a WordPress permalink structure?

FAQ

Which WooCommerce method exposes a direct file URL?

Redirect only. WooCommerce's Digital/Downloadable Product Guide says that it exposes the file URL and that anyone with the URL can access the file.

Do Force Downloads and X-Accel-Redirect expose the same kind of URL?

Force Downloads prevents direct linking through PHP. X-Accel-Redirect/X-Sendfile sends the file through the web server, with protection dependent on the server module and its configuration.

Can Force Downloads still fall back to a redirect?

Yes, when Allow using redirect mode (insecure) as a last resort is enabled. WooCommerce documents this fallback for Force Downloads and X-Accel-Redirect/X-Sendfile when a remotely hosted file cannot be delivered by the selected method.

Sources

1. WooCommerce, "Products Settings Documentation", 4 September 2026
2. WooCommerce, "Digital/Downloadable Product Guide", 9 October 2026

---

Check how a page reads to answer engines. Open the GEO score analyzer