Private Download provides download access control for files in the private file system.

Private files are managed by the Drupal core private file system. Site file system paths are defined on the File system page (Administer > Configuration > Media: File system). See for guidance in setting up a private file system.


You may not need this module. Suppose you create a Drupal core file field on a entity type and configure the file field upload destination as private files. If the entity type is restricted to certain users, access to the file field will automatically have these same access restrictions. If this default behavior is sufficient for your purposes, you do not need this module. If you need more sophisticated behavior, such as having more restrictive access to the file field than exists on the entity type, this module might be able to help.

Private Download restricts download access from the private file system to users having the 'access private download directory' permission. In addition, developers may implement hook_private_download_access() to control access further, e.g., to provide custom access control on a directory-by-directory basis.

Private Download does not provide the means to upload files to the private file system. The Drupal core file field may be configured to upload files directly to the private file system. Alternatively, site administrators may upload files via FTP or a file manager application.

Configurable administrative settings

  • Define download file header attributes
  • Inline download disposition of specified file types
  • Allow/Deny priority which resolves any access control conflicts

This module was originally inspired by a blog post on

Special thanks to anrikun (Henri MEDOT) for volunteering to serve as co-maintainer.

Project Information