woocommerce for downloadable products

You have two options:

1. You can put a blank file named index.html / or index.php in that directory.
   Some WordPress Plugins and the Core use an index.php file with just

   <?php // Silence is golden.

   in them

2. A more secure way is to put a file named .htaccess in the /wp-content/uploads/ directory consisting of only this line:
   Options -indexes
   This way is all sub-directories of this directory will also get their directory listings turned off at once.

With the .htaccess option instead of giving your users a listing they will get a 403: Forbidden Error

That is a good question…

I can only guess that is what the force downloads option of the software is for, this way in theory your raw links shouldn’t be exposed, yes even with this option if somebody knows the architecture of the site and has some knowledge of how it works they can easily go searching on their own…