Disable or prevent PDF files from being downloaded
Why preventing PDF downloads is useless and how to protect PDF files so that only authorized users can open them regardless of who downloads them.
Why disable or prevent download of PDF files from web pages?
When hosting a PDF on a website or cloud service, you may not want everybody who has access to be able to download it. Allowing unlimited downloads of PDF files typically enables mass sharing or removes whatever document usage restrictions (printing, editing, etc.) the host has applied. You can likely think of dozens of ways to prevent a PDF file from being downloaded or printed, but doing so successfully might be much harder than you expect. To explain why, it’s necessary to look at several different solutions to prevent, stop, restrict, block or disable PDF download, why they don’t work, and what the secure alternatives are.
The difficulties in preventing PDF downloads
Part of the difficulty in preventing PDF downloads from a web page lies in the numerous ways there are to obtain them. Though we often think of downloading as the act of pressing a download button and receiving a file, its technical definition is just the copying of content from one computer to another via the internet. Users can therefore download PDFs by:
- Pressing a download button
- Printing the PDF to file drivers (typically as a PDF)
- Finding the file in the webpage’s source code and saving it from its URL
- Copy and pasting the contents of the PDF into a fresh document on their local PDF
- Screenshotting the pages of the document to download them as images
Some of these are easy enough to address. Others, however, are extremely challenging.
How to prevent the download of a PDF file from a webpage
The three main solutions used to prevent PDF downloads are:
- Web page password protection & download links
- CMS plugins and ACL permissions
They are all flawed in their own ways.
Web Page password protection & PDF download links
Web Page password protection
It stands to reason that if you can stop somebody from accessing the page the PDF is hosted on or the download link for a PDF, then you can stop them from downloading it. Of course, this is not used to stop downloads entirely, but rather to stop unauthorized users from downloading the file.
The most common way to control who can access a page is by requiring users to enter a password or login to an authorized user account.
However, it doesn’t take a genius to figure out that anybody with the password (or user account credentials) can share that password with anybody else. Most likely however, they will just download the PDF and then upload it to a file sharing server for others to access.
PDF download links are another attempt to control who can and can’t download a PDF. The idea is that each person gets a unique download link which is only made available for a limited period of time or use before it becomes inaccessible (allowing nobody else to download the file).
Again, this has the same problem as controlling access to a web page – an authorized user can share the downloaded PDF with whoever they want.
With both download links and web page password protection, you need to think about why you’re trying to prevent downloads of PDF files. If it’s because you want to limit who can view the PDF, both are useless. You might prevent PDF downloads by those who randomly happen across your webpage or download URL, but you aren’t going to stop piracy or other unauthorized sharing with either method. An authorized user can just upload the file somewhere else for others to download. Your PDF is still widely available, and you have less visibility to boot.
CMS plugins and ACL permissions
WordPress: Prevent PDF download plugins
Using SharePoint to prevent PDF downloads
Microsoft SharePoint has a “view only” permission which allows users to view PDFs in the browser window but not download them.
The implementation here isn’t terrible – as far as we can tell, it effectively blocks editing and printing. It’s still not perfect, however – see SharePoint Security. Users can still copy and paste by highlighting text in the document and then opening their browser’s developer mode. They can also screenshot the page using third-party screenshot tools, with numerous scripts and programs available to automate the screenshot process.
Why preventing PDF downloads is useless
As you may have guessed by now, preventing PDF downloads isn’t feasible. The browser cannot exert enough control over a user’s system to prevent screenshots or file driver printing and the mechanisms used to enforce document controls are too easy to remove.
But if you want to stop sharing, it’s not the downloading itself that’s the problem – it’s the fact that doing so grants access to unprotected files which can then be shared. If you can make it so that downloaded files are not accessible to unauthorized parties and cannot be misused (copied, edited printed, etc.), then you have achieved your goals.
How to stop or prevent an Adobe PDF from opening after download
There are several ways to protect PDFs against opening, including PGP encryption and Adobe Acrobat password protection. The problem is that passwords and PGP keys can be shared with unauthorized users along with the file. Both methods also do little to protect the PDF once the user has opened it. PGP. Though Adobe has a permissions password designed to prevent editing, copy paste, and printing, it is trivial to remove using free tools.
This allows an authorized user to copy and paste or print the contents to a new file and share that instead.
If you want to control what happens to your downloaded PDFs, a digital rights management (DRM) solution is therefore the only workable option.
How to prevent an Adobe PDF from opening after download using DRM
Locklizard Safeguard DRM was designed with one purpose in mind: preventing the unauthorized access and misuse of PDF files. A combination of encryption, transparent licensing, DRM restrictions and a secure viewer application gives publishers complete control over who can open their PDF documents and what they can do with them. Locklizard enables you to:
- Stop copying, editing, and saving
- Prevent or control printing
- Set an expiry date for your documents
- Create dynamic watermarks that include the user’s name and company (to prevent redistribution via printouts and photos)
- Revoke documents or users manually at any time, regardless of where the document is stored
- Lock documents to devices and locations
- Track who is opening and printing your documents, when, and from where
Here’s how to prevent a PDF from opening after download:
- Right-click on a PDF file on your computer and select “Make Secure PDF”, then choose the DRM controls you want to enforce in Safeguard Writer. Optionally, add a dynamic watermark that will display the user’s name. This will deter them from taking pictures of the screen with a mobile phone or similar device.
- When you press “Publish”, your secured PDF is saved to your disk as an encrypted file, and a document record is created on the Admin System.
- You create a user account for each user you want to view your secured PDF by pressing “Add” in the “Customers” tab of your admin system. An email is automatically sent to the user with a link to the Viewer and their license.
- You upload the PDF to your website. Only users who have a valid license file activated on their device will be able to open the PDF, and only in the secure viewer application.
The best way to prevent download of PDFs from a web page
Locklizard provides a simple, effective, and cost-friendly way to secure PDF downloads from sharing and misuse. Rather than fruitlessly trying to stop the download from happening, it focuses on the desired outcome: the prevention of piracy and leaks. Anyone can download a restricted PDF file, but only authorized users can open it. This leads to both better security and a better experience for users, as they don’t need a persistent internet connection to view restricted PDF files.
Is it possible to make a PDF non-downloadable?
Yes – you could achieve this by adding a very strong random password to the download link or cloud storage account and never sharing it. However, as soon as you share the password with an untrusted party, you run the risk of them sharing it or the downloaded PDF with whomever they like.
How do I stop Adobe PDFs from being downloaded and printed?
There’s no good way to stop a PDF from being downloadable for some users and not others because browser-based controls just aren’t effective. Adobe restrictions or permissions to prevent printing are also useless since they can be instantly removed. Preventing printing for downloaded files is possible, however, by utilizing a PDF DRM solution such as Locklizard.
How do I make a PDF read-only?
By protecting it with Locklizard Safeguard as outlined in our guide, how to make a PDF read-only.
How do I allow viewing but prevent downloading of PDF files in WordPress?
There’s no way to do this effectively. Though several WordPress plugins allow you to embed PDFs without a download button appearing (or the download button is disabled), there are numerous other ways for users to download your files, such as copy pasting, using the browser’s developer mode, screenshotting, etc. More details about WordPress PDF security can be found at Using WordPress for secure sharing of PDF files.
What security settings prevent PDF download?
It depends on the application. However, you must also prevent printing and copying to successfully prevent downloads and restrict opening after download to authorized users only. If you also stop a PDF from opening in the browser, it will be much more secure: users cannot easily bypass security restrictions in a dedicated reader or viewer app.
Can you prevent someone from saving a PDF?
Yes. Locklizard Safeguard DRM disables the save button to prevent saving to unprotected PDF files. It also prevents users from copying content to another file for saving via copy and paste, file driver printing, and screenshots.
How do I protect a PDF from a screenshot?
By using DRM software that utilizes a device-installed viewer application, as browser-based screenshot controls are not effective. Third-party screen grabbing tools or OS-specific ones such as Windows Snipping Tool can easily bypass browser screen grabbing restrictions.
Does WordPress prevent a PDF from opening after download?
No, once a user has downloaded a PDF anyone can open it. This means it can be easily shared with unauthorized users.
Can you prevent PDF download in Moodle?
Just like SharePoint, Moodle has an option to prevent download of course content. It can prevent download of PDFs and other file types.
However, it does not prevent printing or copying of content, so is effectively useless.
There are various Moodle plugins such as ‘Secure PDF’ that claim to prevent students from downloading courses by displaying the pages as images. However, they can still be printed to PDF files and screen grabbed. Displaying PDF files as images can also negatively affect users with poor internet connections since pages will take longer to display.
Is it possible to disable PDF download by disabling the download button?
Can you download a restricted PDF from Google Drive?
Yes, by printing to a PDF. See Is Google Drive secure? for how to easily remove print restrictions.