how to sell an ebook with woocommerce (or give one away)

There are two reasons a WooCommerce store ends up with an ebook. You want to sell it, or you want to give it away in return for some attention, like a free guide, a lookbook or a price sheet. They sound like the same job. They aren’t, and the tool that’s right for one is wrong for the other.

Selling one is mostly built into WooCommerce already. You just have to change a few settings that ship in a state you probably don’t want. Giving one away is where most stores leak the file, because the obvious way to do it puts the real file address in the page for anyone to copy.

Here’s both.

selling an ebook: use woocommerce’s own downloadable products

You don’t need a plugin to sell a PDF. WooCommerce has done it for years: a product that is virtual (nothing to ship) and downloadable (a file the buyer gets after paying).

1. Products → Add New. Give it a title, a description and a price as normal.
2. In Product data, tick Virtual and Downloadable. Virtual takes away the shipping step; Downloadable adds the file fields.
3. Under Downloadable files, add the file. You can add more than one, so if you have the book as a PDF and an EPUB, put both on the same product. The buyer gets both, and nobody has to email you asking for the other format.
4. Set Download limit and Download expiry (more on the numbers below).
5. Publish.

After payment, the buyer gets download links on the order confirmation page, in the order email and in their account. The link points at WooCommerce, not straight at the file, and WooCommerce checks the order before it serves anything.

the settings to check before your first sale

Go to WooCommerce → Settings → Products → Downloadable products. These are the ones that decide whether a paid ebook stays paid.

• File download method. Use Force downloads (or X-Accel-Redirect/X-Sendfile if your host supports it; that one’s faster for big files). Avoid Redirect only: WooCommerce itself labels it insecure, because it sends the buyer to the real file address. Once that address exists in someone’s browser history, it can be passed around.
• Downloads require login. Tick it if your customers have accounts. Without it, anyone holding the download link can use it.
• Grant access to downloadable products after payment. Leave this on, so a buyer gets the file when the payment completes, not when you get round to marking the order complete by hand.

If you’re on an Nginx server, check one more thing with your host. WooCommerce stores product files in a protected folder (woocommerce_uploads). On Apache it protects that folder with an .htaccess file. Nginx ignores .htaccess, so the protection needs a server rule instead, and without it a guessed file address may just work.

download limit and expiry: be kinder than you think

The instinct is to lock it down: one download, 24 hours. Then a customer buys on their phone, opens the email on their laptop the next evening, and you’ve got a support ticket and maybe a refund request.

There’s no right number, but here’s how to think about it:

• The limit counts per order, per file. It stops one link being shared around a forum; it doesn’t stop the buyer forwarding the PDF itself. Nothing does (see below). So a limit of 1 mostly punishes people who own two devices. A small handful is a reasonable middle.
• Expiry protects old links, not the book. A short expiry means a link that leaks next year is dead. It also means a buyer who comes back next year to re-download is stuck. If you set one, say so on the product page, so it’s a stated term rather than a surprise.

what woocommerce won’t do (and nobody honestly can)

Once a buyer has downloaded the PDF, it’s a file on their computer. WooCommerce has no DRM, and no setting stops them emailing it to a friend. Some plugins stamp the buyer’s name into each copy, which discourages it. That isn’t us, and it isn’t something core WooCommerce does.

Our honest take: price the ebook for the people who would pay anyway, make buying it easy, and don’t build your whole setup around the person who was never going to.

giving one away: the leak is the file address

Now the other job. You’ve written a free guide and you want it on a landing page, or in a welcome email, or behind a signup form.

The obvious way to do it is to upload the PDF to the Media Library and link to it. That puts an address like /wp-content/uploads/2026/10/the-guide.pdf in your page. Anyone can copy it, post it anywhere and hot-link it forever, and it will keep working whether or not they ever saw your page.

This is the job we built Secure File Downloads for. It’s free on WordPress.org. Here’s exactly what it does:

• You pick a file that’s already in your Media Library, and the plugin gives it a stable File ID.
• You place a download button anywhere with a shortcode: [bbasfd_download id="FILE_ID"]. It works in the block editor, a classic page or Elementor’s Shortcode widget. Add text="Get the free guide" to change the button label.
• The button points at the plugin’s download endpoint, not at the file. The real /wp-content/uploads/ address never appears in your page HTML.
• The link carries a WordPress security token, so a copied link stops working after a while instead of living forever.

There’s no cap on how many files you can protect on the free version.

what it doesn’t do

We’d rather you know this before you install it than after:

• It doesn’t check that anyone paid. It’s not a replacement for WooCommerce’s downloadable products. For a paid ebook, use the WooCommerce setup above.
• It doesn’t collect an email. If you want an address in exchange for the guide, put the button on the thank-you page your form plugin sends people to after they sign up, or in the email they receive.
• Logged-out visitors can download by default. That’s usually what you want for a free guide. A developer can require login with the bbasfd_allow_logged_out_downloads filter.
• It doesn’t move or block the original file. It stops the address being published; it doesn’t make an address that’s already out there stop working. If the old URL of your guide is already doing the rounds, upload a fresh copy (a new file, so a new address), protect that one, and delete the old one from the Media Library.

when pro is worth it

The Pro add-on doesn’t unlock more files. It adds three things for the free-guide job: download analytics (who downloaded what, and when), a password per file (send the password in the welcome email, so only subscribers can open the download), and a download cap per file (stop a single file being pulled more than a set number of times in total). If you don’t need any of those, the free version is the whole fix.

the 10-minute check

Whichever job you’re doing, do this before you announce it:

1. Buy your own ebook with a 100% coupon, using an account that isn’t an admin. Check the email arrives, the link works, and you get the right file.
2. Copy the download link and open it in a private window. For a paid ebook with login required, it should refuse you. For a free guide, it should work, and it shouldn’t show a /wp-content/uploads/ address.
3. View the page source of your free-guide page and search for uploads. If the PDF’s address is in there, something is still linking to the file directly.
4. Re-download from the customer’s account page, to check your download limit isn’t so tight that it stops a real buyer.

That’s it. A paid ebook only needs WooCommerce’s own downloads, set up properly. A free one needs its file address kept out of the page.