selling digital products woocommerce requires more than uploading files — it requires configuring access rules, choosing a secure delivery method, and having a repeatable customer QA process. This article walks an owner or administrator through configuration, tests, failure modes, and maintenance tasks for reliable digital delivery.
How WooCommerce Handles Downloadable Files
WooCommerce attaches file records to downloadable products and controls access via order status and per-order permissions. Built-in delivery methods usually include Force Downloads, X-Accel/X-Sendfile (recommended when available), and Redirect Only. Each method changes how the server serves files and how protected those files are from direct linking.
Key Concepts
- Download permissions: Granted automatically on successful payment or set manually for free products.
- Order status: Controls access — most stores grant files on Completed orders; some will grant on Processing for virtual-only orders.
- Download limits and expiry: Optional per-product limits and expiration timestamps reduce link leakage risk.
Configuring Product Files And Access Rules
When creating a downloadable product, set the file name, file URL (or upload via the product editor), download limit, and expiry. Decide whether to mark the product as virtual and downloadable so no shipping is required.
Recommended Defaults
- Grant downloads on Completed for mixed carts; consider Processing for instant-delivery virtual-only carts after assessing fraud risk.
- Set a reasonable expiry (e.g., 30–365 days) based on licensing and customer expectations.
- Keep download limits unless you must permit unlimited redownloads.
File Storage Options And Practical Boundaries
Files can be stored on the site server, behind the webroot, or on external storage (S3, CDN). Each choice has trade-offs:
- Local storage: Simpler to set up; may overload shared hosts for many large downloads.
- Server-accelerated delivery (X-Sendfile/X-Accel): Efficient and secure if your host supports it.
- External storage/CDN: Best for large files and global delivery; requires signed URLs or short expirations to prevent hotlinking.
Implementation boundary: If many concurrent large downloads are expected, plan for offloading to S3 or a CDN rather than relying on shared hosting or PHP-driven downloads.
Security And Access Control Considerations
- Never expose raw file paths in emails. Use WooCommerce’s generated secure download links.
- Use server-level delivery (X-Sendfile/X-Accel) when available to avoid PHP buffering and to keep files outside webroot.
- For high-value items, combine short expirations, download limits, and per-user authentication to reduce piracy risk.
- Consider legal/licensing metadata in the customer email and EULA acceptance during checkout.
Customer QA: Tests Every Store Should Run
Customer-facing QA ensures real buyers can complete the download flow. Build these into a checklist and run them after changes, major updates, or hosting moves.
Order Flow Tests
- Purchase a free and a paid downloadable product using a real payment gateway sandbox and a live card test environment.
- Confirm emails: order received, order completed, email contains accessible download links and clear instructions.
- Download from the email link, then download from the customer account page to ensure both methods work.
- Test download limits and expiry by setting a low limit/short expiry and confirming behavior after limit/expiry is reached.
- Simulate refunds and cancellations: ensure access is revoked as intended when an order is refunded or manually revoked.
Edge Customer Tests
- Attempt to reuse an expired link to confirm it fails.
- Try direct guessing of download URLs (should not provide file access).
- Test large file downloads and reconnections on different networks and devices.
Common Failure Cases And Troubleshooting
Expect and prepare for the following failures; they cover most support tickets:
- Corrupt or truncated downloads: Often due to PHP memory/timeout or improper server buffering. Use X-Sendfile/X-Accel or CDN for large files.
- Access denied errors: Check order status, download permissions, and whether the product is still marked downloadable.
- Direct link works unexpectedly: Files stored in webroot or misconfigured redirects can expose files. Move files outside webroot and use server methods.
- Email links missing: Email template changes, SMTP misconfiguration, or spam filters may block messages—test SMTP and review logs.
QA Checklist For Support Staff
- Verify order status and payment gateway logs for the transaction.
- Confirm the product is marked downloadable and attached file URL is correct.
- Check customer’s download count and expiry timestamp in the order admin screen.
- Attempt to download the file using the admin-descoped download link to reproduce the error.
- Review server error logs and PHP limits (memory_limit, max_execution_time) if downloads fail mid-transfer.
Maintenance And Ongoing Tasks
Regular maintenance prevents regressions and preserves security.
- Monthly: Run a purchase test for each major product type and record results.
- Quarterly: Audit download storage — confirm files are correct, backed up, and not publicly accessible.
- After site or host changes: Re-run the full customer QA checklist, especially when moving hosts or enabling/disabling server features.
- Annually: Review expirations and limits versus customer expectations and update documentation or FAQs.
Additional Resources
Use the official WooCommerce documentation for product configuration and managing downloads: Virtual & Downloadable Products and Managing Downloadable Products.
Practical boundaries, disciplined QA, and regular maintenance will reduce support volume and protect revenue when selling digital products. If you face repeated failures tied to hosting limits or large file delivery, plan to move files to a CDN or object storage with signed, time-limited URLs.
Test Secure Delivery
Run a paid order, a failed payment, a refunded order, an expired link, a repeated download, a guest purchase, and a customer who loses access. Confirm that the file URL is protected, the download limit follows policy, the order state controls access, and the email contains the correct instructions.
Keep files, licenses, taxes, updates, backups, and customer support separate from the public media library. Review the workflow after payment or storage changes.
