Guide · 26 August 2026

Protecting digital downloads from piracy — what works, and what doesn't

Most advice on this is either useless or dishonest. Here is what genuinely reduces leaks, what is theatre, and the one limit no platform on earth can get around.

You cannot stop a determined buyer sharing a file they have downloaded — no platform can, and anyone claiming otherwise is selling you something. What you can do is make casual sharing pointless and deliberate leaking traceable: give each buyer a link that expires and only works a set number of times, keep files off any public address, revoke access when you refund, and stamp documents with the buyer's email. Those four measures handle almost all real-world leakage.

TL;DR

• Never rely on a secret URL. If it is publicly reachable, assume it is public.
• Per-buyer expiring links plus a download limit stop one purchase becoming a mirror.
• Revocation matters most on refunds — the highest-risk moment for any digital product.
• PDF stamping with the buyer's email is a deterrent, not a lock. Deterrents work.
• DRM on a downloadable file is theatre. It annoys honest buyers and stops nobody serious.

The thing most stores get wrong

The common setup is a file in cloud storage with a long, unguessable URL, handed out after payment. The reasoning is that nobody will find it. The problem is nobody needs to find it — one buyer posts it to a forum and it is public forever, with no way to switch it off.

The correct model inverts it. The file has no public address at all. Access is minted per buyer, expires, is counted, and can be withdrawn.

What actually works

• Private storage. The file should not be reachable from the internet without a signed request. No unlisted URL, no 'anyone with the link'.
• Per-buyer signed links that expire in minutes. Even a leaked link is worthless almost immediately.
• A download limit per buyer — five is plenty for a genuine customer replacing a lost file, and useless as a distribution channel.
• Revocation. Refunds and chargebacks are when access should end, and most platforms have no way to do it.
• Stamping. Printing the buyer's email on every page of a PDF makes a leak traceable, and buyers knowing that is most of the effect.

What doesn't

• DRM on downloadable files. It breaks on legitimate devices, generates support tickets, and is removed by anyone who cares within minutes.
• Password-protected archives. The password travels with the file.
• Watermarking images so heavily that the product is degraded — you have punished the buyer, not the pirate.
• Legal threats in your terms. Nobody reading them was going to leak it anyway.

The honest frame: you are not trying to achieve zero piracy. You are making casual sharing inconvenient and deliberate leaking attributable. That is achievable, and it is enough.

How it works on SitesPlaced

• Files are stored privately on Cloudflare R2 with public access switched off and no domain attached — there is no URL to guess or share.
• Each buyer gets their own signed link that expires after minutes, issued only after we check their purchase.
• You choose how many downloads each buyer gets and how long their link lives.
• Refunded someone? Disable their link from the order and it stops working immediately.
• Nothing stops a buyer sharing a file they have already downloaded — that is true on every platform. Limits, expiry and revocation are the real controls, and you have all three.

PDF stamping is on our list and not shipped yet — worth saying plainly rather than implying otherwise.

The commercial angle nobody mentions

Most leaked files come from people who were never going to buy. Time spent hardening against them usually returns less than time spent giving real buyers a reason to come back: updates, a version 2, a community, something the file alone does not carry.

Protect the file sensibly, then stop thinking about it.

Frequently asked questions

Can I stop people sharing my digital product?

Not completely, and any platform claiming otherwise is overselling. Once a buyer has the file they can copy it. What you can do is make casual sharing pointless with expiring per-buyer links and download limits, and make deliberate leaking traceable with stamping.

Are expiring download links worth it?

Yes — they are the single most effective measure. A link that dies after minutes cannot be posted anywhere useful, and the file itself never sits at a public address.

What is PDF stamping?

Printing the buyer's email address on every page of the PDF they downloaded. It does not prevent sharing but makes leaks traceable to a buyer, and buyers knowing it is happening is most of the deterrent. Sellfy and ownstreet offer it; we have it planned.

Should I use DRM?

For downloadable files, no. It breaks on real devices, creates support work, and is trivially removed by anyone motivated. You end up penalising honest customers.

What happens if I refund someone?

You should be able to revoke their download link, and on SitesPlaced you can — disable it from the order and it stops working immediately. Many platforms have no way to do this at all.