woothemes/woocommerce — comment on commit 89a289b0c45119cad50fde6cdcd14d4857d70233
File: woocommerce_actions.php line 765
By joeblackwaslike:

just fyi this one will give away your location in your headers and would recccomend an apache directive to deny access to it and its directory directly. curl -I [download_url] shows all, here i've masked the bits id rather not post with stars.

HTTP/1.1 200 OK
Date: Tue, 08 Nov 2011 06:13:52 GMT
Server: Apache
Set-Cookie: PHPSESSID=e8ku7cb5ortokln2mcgen0k75m7jcnps; path=/
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
X-Accel-Redirect: /home/******/web/public/dls/********.zip
Content-Disposition: attachment; filename="***********.zip";
Vary: Accept-Encoding
Last-Modified: Wed, 26 Oct 2011 10:11:20 GMT
ETag: "26f21-1d977bdb-4b030e09f0d67"
Content-Length: 496466907
Content-Type: application/zip