How to prevent download of PDF from web pages

Disable or prevent PDF files from being downloaded

Why preventing PDF downloads is useless and how to protect PDF files so that only authorized users can open them regardless of who downloads them.

  Why disable or prevent download of PDF files from web pages?

When hosting a PDF on a website or cloud service, you may not want everybody who has access to be able to download it.  Allowing unlimited downloads of PDF files typically enables mass sharing or removes whatever document usage restrictions (printing, editing, etc.) the host has applied.  You can likely think of dozens of ways to prevent a PDF file from being downloaded or printed, but doing so successfully might be much harder than you expect.  To explain why, we’ll cover:

1. The difficulties of preventing PDF downloads
2. How to prevent the download of a PDF file from a webpage
3. Can you prevent a PDF on a website from being downloaded or printed?
4. How to prevent an Adobe PDF from opening after download
5. How to prevent an Adobe PDF from opening after download using DRM
6. The best way to prevent download of PDFs from  web page

   The difficulties of preventing PDF downloads

Part of the difficulty in preventing PDF downloads from a web page lies in the numerous ways there are to obtain them. Though we often think of downloading as the act of pressing a download button and receiving a file, its technical definition is just the copying of content from one computer to another via the internet.  Users can therefore download PDFs by:

1. Pressing a download button
2. Printing the PDF to file drivers (typically as a PDF)
3. Finding the file in the webpage’s source code and saving it from its URL
4. Copy and pasting the contents of the PDF into a fresh document on their local PDF
5. Screenshotting the pages of the document to download them as images
6. Sharing their account details with others
7. Using AI web scraping tools

Some of these are easy enough to address.  Others, however, are extremely challenging.

   How to prevent the download of a PDF file from a webpage

The three main solutions used to prevent PDF downloads are:

1. Web page password protection & download links
2. JavaScript protection
3. CMS plugins and ACL permissions

They are all flawed in their own ways.

   How to secure a downloadable PDF on a website

Web Page password protection

It stands to reason that if you can stop somebody from accessing the page the PDF is hosted on or the download link for a PDF, then you can stop them from downloading it.  Of course, this is not used to stop downloads entirely, but rather to stop unauthorized users from downloading the file.

The most common way to control who can access a page is by requiring users to enter a password or login to an authorized user account.

However, it doesn’t take a genius to figure out that anybody with the password (or user account credentials) can share that password with anybody else.  Most likely however, they will just download the PDF and then upload it to a file sharing server for others to access.

Download links

PDF download links are another attempt to control who can and can’t download a PDF.  The idea is that each person gets a unique download link which is only made available for a limited period of time or use before it becomes inaccessible (allowing nobody else to download the file).

Again, this has the same problem as controlling access to a web page – an authorized user can share the downloaded PDF with whoever they want.

With both download links and web page password protection, you need to think about why you’re trying to prevent downloads of PDF files.  If it’s because you want to limit who can view the PDF, both are useless.  You might prevent PDF downloads by those who randomly happen across your webpage or download URL, but you aren’t going to stop piracy or other unauthorized sharing with either method.  An authorized user can just upload the file somewhere else for others to download.  Your PDF is still widely available, and you have less visibility to boot.

   How to prevent a PDF from being downloaded with JavaScript protection

JavaScript (JS) is one of the few ways to prevent the download of a PDF from a web page while allowing users to view it online.  JS is used to disable the download button.  You’ll see this approach used often in secure data rooms, PDF flipbooks, and cloud storage/collaboration platforms such as Google Docs.  The PDF is displayed via a HTML web viewer, but JavaScript controls restrict what users can do with it, disabling the ability to print, download, copy paste, and edit.

It’s a nice idea, but the controls are, unfortunately, just too easy to bypass.  JavaScript controls are executed on the client side, which means they can be bypassed, disabled, or modified even by non-technical users via the browser developer mode.  See Google Docs Security as a classic example.

Additionally, there are certain things that JavaScript alone just cannot do.  This includes blocking screenshots and preventing printing of PDF docs to file drivers if printing is enabled (see how to make a Google Doc a PDF for an example of this).  You aren’t really preventing downloading if you can’t stop these, as users can easily create a PDF for use offline.

   CMS plugins and ACL permissions

WordPress: Disable PDF downloads using plugins

WordPress is probably the most popular solution used today to publish web content.  WordPress has a strong plugin ecosystem and this has led to the development of various plugins that claim to prevent PDF downloads or plugins that restrict PDF from download or printing.  They usually achieve this by embedding the PDF directly into blog posts and disabling or removing the button to download it in the PDF viewer.  Others use JavaScript controls to further try to prevent printing and copy and pasting.

As you can probably guess, however, these controls are no more effective than the JavaScript controls you’ll see in other solutions.  Users can easily bypass the controls using their web browser’s developer mode and can freely screenshot.

Using SharePoint to prevent PDF downloads

You can use SharePoint to prevent PDF downloads via its “view only” permission. This allows users to view PDFs in the browser window but not download them.

SharePoint PDF download prevention isn’t terrible; as far as we can tell, it effectively blocks editing and printing.  It’s still not perfect, however – see SharePoint Security.  Users can still copy and paste by highlighting text in the document and then opening their browser’s developer mode.  They can also screenshot the page using third-party screenshot tools, with numerous scripts and programs available to automate the screenshot process.

  How to download a PDF from a restricted site

In summary, there are many ways to download a restricted PDF from webpages even if the developer has taken certain precautions. Some only take a few seconds, while others are more time-consuming.

This is how to download a PDF from a website that is not downloadable:

1. Check if there are any download or print buttons you can use to either download the original PDF or print to PDF to create a copy. You can also try right-clicking the PDF and selecting “Save as…”.
   
2. If there are no download buttons, open the developer mode of your browser with Ctrl + Shift + I and looking through the “Sources” tab for PDF file.
   
   Once you find it, right-click it and press “Save as”.
3. Open the “Network” tab of your browser’s developer mode and refresh the page.  Search for .pdf. If a PDF appears, right-click it and press “Save as”.
   
4. Try saving the entire webpage as an HMTL file and then opening it in your browser.  This is particularly effective with PDFs in flipbook format.
   
5. Download the page hosting the PDF and look for the code that hides the download button.  Change the code to re-enable the button, open the HTML file in your browser and press the button to download the original PDF.
   
   
6. Use an automated screenshot tool such as Fireshot to screenshot every page and save the result as a PDF.
   
7. Some sites render each PDF page as an image. Search for these images in the “Sources” tab and download them (you can use a browser add-on or script to speed this up).  Then, combine them into a PDF and run it through an OCR tool.
   

And these are just the general methods easily accessible to the average user.  A web developer or hacker could modify the JavaScript that executes in the browser or write scripts or browser extensions to create a good output PDF in almost all cases.

Can you prevent a PDF on a website from being downloaded or printed?

As you may have guessed by now, preventing PDF downloads isn’t feasible.  The browser cannot exert enough control over a user’s system to prevent screenshots or file driver printing and the mechanisms used to enforce document controls are too easy to remove.

But if you want to stop sharing, it’s not the downloading itself that’s the problem – it’s the fact that doing so grants access to unprotected files which can then be shared.  If you can make it so that downloaded files are not accessible to unauthorized parties and cannot be misused (copied, edited printed, etc.), then you have achieved your goals.

How to stop or prevent an Adobe PDF from opening after download

There are several ways to protect PDFs against opening, including PGP encryption and Adobe Acrobat password protection.  The problem is that passwords and PGP keys can be shared with unauthorized users along with the file.  Both methods also do little to protect the PDF once the user has opened it.  Though Adobe has a permissions password designed to prevent editing, copy paste, and printing, it is trivial to remove using free tools.

This allows an authorized user to copy and paste or print the contents to a new file and share that instead.

If you want to control what happens to your downloaded PDFs, a digital rights management (DRM) solution is therefore the only workable option.

How to prevent an Adobe PDF from opening after download using DRM

Locklizard Safeguard DRM was designed with one purpose in mind: preventing the unauthorized access and misuse of PDF files.  A combination of encryption, transparent licensing, DRM restrictions and a secure viewer application gives publishers complete control over who can open their PDF documents and what they can do with them.  Locklizard enables you to:

• Stop copying, editing, and saving
• Prevent or control printing
• Set an expiry date for your documents
• Create dynamic watermarks that include the user’s name and company (to prevent redistribution via printouts and photos)
• Revoke documents or users manually at any time, regardless of where the document is stored
• Lock documents to devices and locations
• Track who is opening and printing your documents, when, and from where

Here’s how to prevent a PDF from opening after download:

1. Right-click on a PDF file on your computer and select “Make Secure PDF”, then choose the DRM controls you want to enforce in Safeguard Writer.  Optionally, add a dynamic watermark that will display the user’s name.  This will deter them from taking pictures of the screen with a mobile phone or similar device.
   
2. When you press “Publish”, your secured PDF is saved to your disk as an encrypted file, and a document record is created on the Admin System.
   
3. You create a user account for each user you want to view your secured PDF by pressing “Add” in the “Customers” tab of your admin system.  An email is automatically sent to the user with a link to the Viewer and their license.
   
4. You upload the PDF to your website.  Only users who have a valid license file activated on their device will be able to open the PDF, and only in the secure viewer application.
   
   

   The best way to prevent download of PDFs from a web page

Locklizard provides a simple, effective, and cost-friendly way to secure PDF downloads from sharing and misuse.  Rather than fruitlessly trying to protect a PDF from download (i.e. stop the download from happening), it focuses on the desired outcome: the prevention of piracy and leaks.  Anyone can download a restricted PDF file, but only authorized users can open it.  This leads to both better security and a better experience for users, as they don’t need a persistent internet connection to view restricted PDF files.

To protect your PDF documents from unauthorized access, piracy and misuse, take a 15-day free trial of our PDF DRM software.

   FAQs

Is it possible to make a PDF non-downloadable?

Yes – you could achieve this by adding a very strong random password to the download link or cloud storage account and never sharing it.  However, as soon as you share the password with an untrusted party, you run the risk of them sharing it or the downloaded PDF with whomever they like.

How do I stop Adobe PDFs from being downloaded and printed?

There’s no good way to stop a PDF from being downloadable for some users and not others because browser-based controls just aren’t effective.  Adobe restrictions or permissions to prevent printing are also useless since they can be instantly removed.  Preventing printing for downloaded files is possible, however, by utilizing a PDF DRM solution such as Locklizard.

How do I make a PDF read-only?

By protecting it with Locklizard Safeguard as outlined in our guide, how to make a PDF read-only.

How do I allow viewing but prevent downloading of PDF files in WordPress?

There’s no way to do this effectively.  Though several WordPress plugins allow you to embed PDFs without a download button appearing (or the download button is disabled), there are numerous other ways for users to download your files, such as copy pasting, using the browser’s developer mode, screenshotting, etc.  More details about WordPress PDF security can be found at Using WordPress for secure sharing of PDF files.

What security settings prevent PDF download?

It depends on the application.  However, you must also prevent printing and copying to successfully prevent downloads and restrict opening after download to authorized users only.  If you also stop a PDF from opening in the browser, it will be much more secure: users cannot easily bypass security restrictions in a dedicated reader or viewer app.

Can you prevent someone from saving a PDF?

Yes.  Locklizard Safeguard DRM disables the save button to prevent saving to unprotected PDF files.  It also prevents users from copying content to another file for saving via copy and paste, file driver printing, and screenshots.

How do I protect a PDF from a screenshot?

By using DRM software that utilizes a device-installed viewer application, as browser-based screenshot controls are not effective.  Third-party screen grabbing tools or OS-specific ones such as Windows Snipping Tool can easily bypass browser screen grabbing restrictions.

Does WordPress prevent a PDF from opening after download?

No, once a user has downloaded a PDF anyone can open it.  This means it can be easily shared with unauthorized users.

Can you prevent PDF download in Moodle?

Just like SharePoint, Moodle has an option to prevent download of course content.  It can prevent download of PDFs and other file types.

However, it does not prevent printing or copying of content, so is effectively useless.

There are various Moodle plugins such as ‘Secure PDF’ that claim to prevent students from downloading courses by displaying the pages as images.  However, they can still be printed to PDF files and screen grabbed.  Displaying PDF files as images can also negatively affect users with poor internet connections since pages will take longer to display.

Is it possible to disable PDF download by disabling the download button?

Not effectively.  This is because JavaScript or JS is used to disable the download button.  Users can edit JS in their browser to change the functionality or load another plugin that uses JS to activate the download button.

Can you download a restricted PDF from Google Drive?

Yes, by printing to a PDF.  See Is Google Drive secure? for how to easily remove print restrictions.