How to make redirected download urls be only accessible by logged-in members?

Option 1:
In PHP you can do a check for is_user_logged_in() and only display the content if it returns true

Option 2 (insecure, but may work for you):
You can check for the existance of a wordpress login cookie (however this will not be validated and can be easily spoofed – should be fine for less secure files)
RewriteCond %{HTTP_COOKIE} !^.*wordpress_logged_in.*$ [NC]
Credits: https://wordpress.stackexchange.com/a/285311

@designsmoke thanks for reply
option 1 is not an option bcz i want to apply it for logged in members as well

how can i implement this code with

RewriteEngine On
RewriteBase /
RewriteCond %{REQUEST_FILENAME} ^.*(mp3|m4a|pdf|doc|xlsx|docx|xls)$
RewriteCond %{HTTP_COOKIE} !^.*wordpress_logged_in.*$ [NC]
RewriteRule (.*) https://website.com/login/

Redirect 301 /resources https://external.com/direct-download-link1 this code?
note: theres no /resources folder actually in my wordpress.

what about this code:

require('../wp-load.php');  // modify to reflect where your PHP file is in relation to WordPress
$roles = wp_get_current_user()->roles;  // get current users role

if (!in_array('alloweduserrole',$roles)) {  // modify to match your roles that are allowed to download

    header('Location: https://www.ourwebsite.com/');
    exit;

}  // end of if user does not have the proper role

You can replace the original .htaccess code with this code, for example. It will redirect you if you have a cookie named “*wordpress_logged_in*”, which is automatically set by wordpress (but can be easily created, so it’s not 100% secure).

RewriteEngine On
RewriteCond %{HTTP_COOKIE} ^.*wordpress_logged_in.*$ [NC]
RewriteRule ^resources/?$ https://external.com/direct-download-link1
 [L,R=301]

• This reply was modified 5 years, 6 months ago by DesignSmoke.

@designsmoke when apply

RewriteEngine On
RewriteCond %{HTTP_COOKIE} ^.*wordpress_logged_in.*$ [NC]
RewriteRule ^resources/?$ https://external.com/direct-download-link1
 [L,R=301]

this code the site went into 500 internal server error.

• This reply was modified 5 years, 6 months ago by vipini.

@vipini Whoops, that’s my bad, I accidentally added a newline before the [L,R=301] and forgot the check for the url. Let me know if this works:

RewriteEngine On
RewriteCond %{HTTP_COOKIE} ^.*wordpress_logged_in.*$ [NC]
RewriteRule ^resources/?$ https://external.com/direct-download-link1 [L,R=301]

• This reply was modified 5 years, 6 months ago by DesignSmoke.

@designsmoke it seems it doesn’t works
i clicked the download link while logged in and it brings up “page not found”
and when i click without loggedin it redirected me to “page not found” as well.

• This reply was modified 5 years, 6 months ago by vipini.

i looked again and it gives “page not found” error for logged-in too? strange..