Protect Against Direct URL Access.

There is, but it’s a lot more complicated then simple uploading a file and linking to it.

You can either do this in your theme, or in a new plugin that you develop. The choice is yours.

You need to have the file stored somewhere that is not accessible by the public. Where it can be placed is different depending on your hosting company and server, so it’s up to you to find out where that is. When you have that you need to set up a script that will check for what referrer it is, where the request has come from and whatever other security measures that you want to put in place. if these are all correct you can output the file form its location using file_get_contents() or another function like that.