Hi Amanda
Thanks for reply
So I checked the folder you mentioned and the .htaccess file is present. I found out that the Force Download option still protect the files uploaded on the main host (which WordPress is installed) but it doesn’t protect files on download host (subdomain).
any advice?