How to make expiring download links & why they don't stop sharing

File share link expiration and download links that expire.

We explain how to create expiring download links using WordPress, PHP/JS, and file cloud storage and why they don’t stop sharing and piracy.

What are expiry links and what are they used for?

An expiry link is a link to a digital file that can only be accessed for a certain period of time.

File share link expiration and expiring download links are often billed as a smart way to create time-limited content for secure file sharing. The logic follows that if you give users a limited time to download their file or document, they have less chance to share it with others and won’t be able to obtain it once it is outdated. We’ll be exploring that claim in this blog, and why expiry links are useless, covering:

Why expire links or file share downloads?
How to expire links to downloads
How effective are expiring links?
Protecting digital downloads without expiring links

Why expire file share links or downloads?

As mentioned, most businesses use expiring download links in an attempt to reduce unauthorized sharing of their product (a document, video, ebook, etc.). However, there are several other use cases to consider:

Reducing the amount of time a product is available
Expiring download links can be useful if you expect the information in your product to become outdated. Removing access to the product and clearly communicating this with the customer makes it clear that the information is no longer safe, compliant, or relevant. It also reduces the amount of time-sensitive information available.
Free trials and subscriptions
Expiring download links can be a convenient way to deny users access to their product after a free trial or subscription period. This is primarily useful for products that frequently require a fresh download.
Resource management
Downloads can place a lot of load on the server that’s hosting them. If you are hosting your own resources, limited-time download links are a way to reduce bandwidth costs and free up server resources by preventing repeat downloads.

We’ll talk a bit about whether expiring links are effective for these use cases later.

When does a URL expire?

The most common type of expiring download link is one that stops functioning on a specific date. But date isn’t the only metric you can use.

For some businesses, it makes more sense to:

Expire the link a number of days since its first use.
Remove the link after a certain number of downloads (or single-use).
Stop access after a number of views.
Stop access after a number of prints.

Unfortunately, most online tools online let you expire a URL on a date or after a number of downloads. You need a separate viewer application with functionality to collect statistics to count views or prints.

How to expire links or make a download link that expires

There are three common ways to create expirable download links: coding them yourself using HTML/JS/PHP, using a WordPress plugin, or utilizing an existing file cloud storage service that supports file share link expiration.

Though each of these is a materially different approach, they provide roughly the same level of security. Which you use primarily comes down to how you are distributing your content.

How to create expiring links in WordPress

WordPress relies on plugins to create download links that expire. There are a few different expiring link generator plugins available:

Download Manager (paid)
Free Downloads WooCommerce (paid, supports number of downloads limit only)
Filr (paid)
Secure Downloads (free, time-based expiry only)
Easy digital downloads (free, number limit only)
WP dispatcher (free, time-based expiry only)

Features and settings vary between link generator plugins, but the general process of setting up expiring download links is the same.

Open the plugin page and press “Add New Plugin”.
Search for your plugin and press “Install Now”, then “Activate”.
Select your plugin in the sidebar and select “Add new file” (or similar).
After adding your file, choose your expiry options and press “Generate” to create a download link that expires. You can usually choose how many days until it expires or how many downloads until it expires.

As we cover however in in using WordPress to share and sell PDF files securely, expiry links are probably not your best option to limit file download access.

Creating expiring download links with PHP/HTML/JS

Web developers can create their own expiring download link systems using common web coding languages such as PHP. There are several ways you can approach this, but the most common implementation is as follows:

Generate a secure token using and associate it with an expiry time. Store it in a secure location where it cannot be accessed.
When a user clicks the download link, send the token to a PHP script that verifies its validity.
If the token is still valid, serve the file. Otherwise, deny access.

There are libraries for most programming languages that can help you to generate tokens securely, including for PHP, JS, Node.js, etc. You can find them here.

How to create expiring download links using a file cloud storage provider

There are several cloud storage providers that allow you to expire links to your files. Typically, this is a paid feature and is often reserved for business customers.

Here are some of the most popular file cloud providers that support file share link expiration:

Proton Drive: Free users can expire sharing links on a set date. This is limited to 2 GB of storage.
Google Drive: Google Workspace subscribers can add an expiration date by sharing a file with a specific user and then choosing an expiry date next to their name in the share menu. See also Google Workspace security, How to share Google Docs securely, How to password protect a Google Doc, and Is Google Drive secure?.
OneDrive: Premium users can add expiration dates to each file link but seemingly not to each user.
Box: Premium users can expire URLs to their file on a set date.
Dropbox: Paid users can expire sharing links on a set date.
MEGA: Free users can set an expiry date on files and get 20 GB free storage.

While file cloud storage is an option for download expiry, it’s not particularly convenient. Most provide one link to the file per upload and expire that, which means a fresh copy for every user if you need separate expiry dates. The ones that let you set it per user, like Google Drive, require you to know the customers’ email in advance and manually share it, which isn’t very scalable.

How effective are expiring download links?

Expiring download links have their place, but that place doesn’t involve document security. They can be good to reduce server load and are of some use to signal that content is out of date.

When using them as an expiry or anti-sharing mechanism, there are several flaws to consider:

The file the customer downloads can still be shared and uploaded elsewhere for free.
Customers can keep files past their trial, subscription, or compliance period by just keeping the original file they downloaded. Expiry dates are, therefore, primarily beneficial if the content you are distributing needs to be updated frequently to stay useful. In such a case, however, you can just upload a new version they don’t have access to – you don’t need to set up expiry.

These factors make file share link expiration or expiring download links useless in most scenarios, but especially in the one they’re most marketed for: preventing digital products from being shared and pirated. To effectively stop mass sharing, you need rights controls that are baked into the file itself.

Do Adobe Acrobat controls stop sharing?

Some articles will tell you that Adobe Acrobat’s PDF password controls are a good way to add additional security to your expiry links or expiring downloads. In reality, this is just layering useless protection on top of useless protection. As we have explained in Why you should not password protect PDF files, the permissions controls Adobe implements can be removed in seconds using free online tools.

Though Acrobat also lets you set a password to open the file, this isn’t much use either. The customer can just share the password alongside the document or remove the password entirely in the app and resave it.

Like it or not, the only real way to prevent the piracy and misuse of your downloads is to use a paid DRM solution.

Protecting digital downloads without expiring links

Locklizard Safeguard PDF DRM lets you expire access to documents and share a link to a PDF securely without creating expiry links. It builds PDF expiry and sharing controls into the document itself, removing the need for expiry links and simplifying management overall.

Here’s how it works:

You open your PDF in the Safeguard Writer application, select your controls (stop printing, screenshots, etc) and a dynamic or image watermark if you wish.
You choose your expiry options, which can include a specific date, a number of days since first open, or after a number of prints/views.
When you select Publish, the Writer app encrypts your PDF so that nobody can view it.
In your admin portal, you add a user and choose the documents you want them to have access to.
The customer gets an email with their license file, instructions, and a link to download the Locklizard Viewer application.
The user installs their (by default) single-use license which is locked to their device so it cannot be shared.
When a user clicks on a protected document in their viewer app, the license is checked. If it’s valid the decryption keys are securely transmitted to their device and the document is opened.
Once the protected document expires, it can no longer be opened.

Locklizard protected PDF controls that stop editing, saving, copy-pasting, and screen grabbing cannot be bypassed and content is only decrypted in memory. As a valid license is required to view the file, the only way to share the file with others is by loaning the device itself. In other words, unless you decide otherwise, each customer gets one copy of your creative work. That usually means more revenue, leading to better content for your customers in the future.

You can compare our DRM software to link expiry today by taking a 15-day free trial.

FAQs

What happens when a download link expires?

When a download link reaches its expiration time, it usually stops serving the file it is associated with. While the link itself often still exists, users will be directed to a page telling them their download has expired.

How do I renew a link when it expires?

Usually when you link has expired you will need to create a new link to the file rather than renewing it. The exception to this is if you build your own expiring links system using HTML/JS/PHP, in which case you can of course build a renewal function.

How do I change expiration on a download link?

Services like OneDrive or Box, as well as WordPress plugins, allow you to go into a file’s properties or sharing settings and change the expiration date there.

Is an expiring link generator secure?

No more secure than using OneDrive, WordPress, etc. In fact, they are typically less secure, as link generator websites don’t tend to have a strong reputation for security when compared to say, Microsoft.

Is it possible to send a file share link expiration email to users?

Yes, some cloud services and WordPress plugins will automatically send an email before/when a link expires. Box only notifies the owner, whereas in OneDrive you can seemingly use SharePoint to set up link expiration options per site, including emailing users when their link is about to expire.

How can I download files from an expired link?

If it’s implemented correctly, you usually can’t. Instead users can upload the file to their own cloud storage for download later or ask somebody else if they can provide them with the file. In other words, expiring links don’t prevent downloads of PDF files and other content by unauthorized users.

How can I set up link expiration for password protected files?

A couple of cloud services support both passwords and file expiration. This includes OneDrive, Proton Drive, Box, and DropBox. Usually it is just a matter of ticking the password option and entering a password, then choosing an expiry date on the calendar.

Do Google Drive download links expire?

Yes, but you must have a Google Workspace subscription.

How do I create expiring links with Download Monitor?

You need to buy both the Download Monitor plugin and its Advanced Access monitor extension and then add a global rule with expiry or set rules on each download.

Why set up link expiration in WordPress?

It can be a good idea to set up link expiration in WordPress if you want to share a PDF online or other files, and limit the load on your server. It means that if somebody wants to share your file, they have to use the resources of a third-party service, such as their messaging app or a cloud provider.