The question says it all.. How do I let the users download a file from my website and not let them see what link that file comes from? I understand that the
readfile should do what you want. Put the actual file outside the web server root, and require some credentials before passing back the file.