You must implement a wrapper on top of your file system and add extra security for this purpose like token.
Let's say your route for downloading is:
<BASE_URL>/download/{x}
and x
is name of the file. This route will only return the file content from ./public_html/files
if user provided a valid token in url like:
<BASE_URL>/download/{x}?token=diji12jidj
All of the implementation of this method depends on your needs, e.g. token can be based on user session or based on time or ...
Here is a simple hint in php:
// First page
session_start();
$_SESSION['download_key'] = random_string() // a function that you can implement in anyway you want
// In you html
<a href="download.php?name=<FILE_NAME>&download_key=<?= $_SESSION['download_key'] ?>">Download here</a>
// File: download.php
if(isset($_SESSION['download_key']) && $_REQUEST['download_key'] == $_SESSION['download_key']) {
// find file
$path = ... // path to file
$fp = fopen($path, 'rb');
// send the right headers
header("Content-Type: image/png"); // or anything else
header("Content-Length: " . filesize($path));
fpassthru($fp);
exit;
}