How to prevent download of PDF from web pages

Disable or prevent PDF files from being downloaded

Why preventing PDF downloads is useless and how to protect PDF files so that only authorized users can open them regardless of who downloads them.

  Why disable or prevent download of PDF files from web pages?

When hosting a PDF on a website or cloud service, you may not want everybody who has access to be able to download it.  Allowing unlimited downloads of PDF files typically enables mass sharing or removes whatever document usage restrictions (printing, editing, etc.) the host has applied.  You can likely think of dozens of ways to prevent a PDF file from being downloaded or printed, but doing so successfully might be much harder than you expect.  To explain why, it’s necessary to look at several different solutions to prevent, stop, restrict, block or disable PDF download, why they don’t work, and what the secure alternatives are.

   The difficulties in preventing PDF downloads

Part of the difficulty in preventing PDF downloads from a web page lies in the numerous ways there are to obtain them. Though we often think of downloading as the act of pressing a download button and receiving a file, its technical definition is just the copying of content from one computer to another via the internet.  Users can therefore download PDFs by:

1. Pressing a download button
2. Printing the PDF to file drivers (typically as a PDF)
3. Finding the file in the webpage’s source code and saving it from its URL
4. Copy and pasting the contents of the PDF into a fresh document on their local PDF
5. Screenshotting the pages of the document to download them as images

Some of these are easy enough to address.  Others, however, are extremely challenging.

   How to prevent the download of a PDF file from a webpage

The three main solutions used to prevent PDF downloads are:

1. Web page password protection & download links
2. JavaScript protection
3. CMS plugins and ACL permissions

They are all flawed in their own ways.

   Web Page password protection & PDF download links

Web Page password protection

It stands to reason that if you can stop somebody from accessing the page the PDF is hosted on or the download link for a PDF, then you can stop them from downloading it.  Of course, this is not used to stop downloads entirely, but rather to stop unauthorized users from downloading the file.

The most common way to control who can access a page is by requiring users to enter a password or login to an authorized user account.

However, it doesn’t take a genius to figure out that anybody with the password (or user account credentials) can share that password with anybody else.  Most likely however, they will just download the PDF and then upload it to a file sharing server for others to access.

Download links

PDF download links are another attempt to control who can and can’t download a PDF.  The idea is that each person gets a unique download link which is only made available for a limited period of time or use before it becomes inaccessible (allowing nobody else to download the file).

Again, this has the same problem as controlling access to a web page – an authorized user can share the downloaded PDF with whoever they want.

With both download links and web page password protection, you need to think about why you’re trying to prevent downloads of PDF files.  If it’s because you want to limit who can view the PDF, both are useless.  You might prevent PDF downloads by those who randomly happen across your webpage or download URL, but you aren’t going to stop piracy or other unauthorized sharing with either method.  An authorized user can just upload the file somewhere else for others to download.  Your PDF is still widely available, and you have less visibility to boot.

   JavaScript protection

JavaScript is one of the few ways to prevent the download of a PDF from a web page while allowing users to view it online.  You’ll see this approach used often in secure data rooms and cloud storage/collaboration platforms such as Google Docs.  The PDF is displayed via a HTML web viewer, but JavaScript controls restrict what users can do with it, disabling the ability to print, download, copy paste, and edit.

It’s a nice idea, but the controls are unfortunately just too easy to bypass.  JavaScript controls are executed on the client side, which means they can be bypassed, disabled, or modified even by non-technical users via the browser developer mode.  See Google Docs Security as a classic example.

Additionally, there are certain things that JavaScript alone just cannot do.  This includes blocking screenshots and preventing printing of PDF docs to file drivers if printing is enabled (see how to make a Google Doc a PDF for an example of this).  You aren’t really preventing downloading if you can’t stop these, as users can easily create a PDF for use offline.

   CMS plugins and ACL permissions

WordPress: Prevent PDF download plugins

WordPress is probably the most popular solution used today to publish web content.  WordPress has a strong plugin ecosystem and this has led to the development of various plugins that claim to prevent PDF downloads or plugins that restrict PDF from download or printing.  They usually achieve this by embedding the PDF directly into blog posts and disabling or removing the button to download it in the PDF viewer.  Others use JavaScript controls to further try to prevent printing and copy and pasting.

As you can probably guess, however, these controls are no more effective than the JavaScript controls you’ll see in other solutions.  Users can easily bypass the controls using their web browser’s developer mode and can freely screenshot.

Using SharePoint to prevent PDF downloads

Microsoft SharePoint has a “view only” permission which allows users to view PDFs in the browser window but not download them.

The implementation here isn’t terrible – as far as we can tell, it effectively blocks editing and printing.  It’s still not perfect, however – see SharePoint Security.  Users can still copy and paste by highlighting text in the document and then opening their browser’s developer mode.  They can also screenshot the page using third-party screenshot tools, with numerous scripts and programs available to automate the screenshot process.

   Why preventing PDF downloads is useless

As you may have guessed by now, preventing PDF downloads isn’t feasible.  The browser cannot exert enough control over a user’s system to prevent screenshots or file driver printing and the mechanisms used to enforce document controls are too easy to remove.

But if you want to stop sharing, it’s not the downloading itself that’s the problem – it’s the fact that doing so grants access to unprotected files which can then be shared.  If you can make it so that downloaded files are not accessible to unauthorized parties and cannot be misused (copied, edited printed, etc.), then you have achieved your goals.

How to stop or prevent an Adobe PDF from opening after download

There are several ways to protect PDFs against opening, including PGP encryption and Adobe Acrobat password protection.  The problem is that passwords and PGP keys can be shared with unauthorized users along with the file.  Both methods also do little to protect the PDF once the user has opened it. PGP.  Though Adobe has a permissions password designed to prevent editing, copy paste, and printing, it is trivial to remove using free tools.

This allows an authorized user to copy and paste or print the contents to a new file and share that instead.

If you want to control what happens to your downloaded PDFs, a digital rights management (DRM) solution is therefore the only workable option.

How to prevent an Adobe PDF from opening after download using DRM

Locklizard Safeguard DRM was designed with one purpose in mind: preventing the unauthorized access and misuse of PDF files.  A combination of encryption, transparent licensing, DRM restrictions and a secure viewer application gives publishers complete control over who can open their PDF documents and what they can do with them.  Locklizard enables you to:

• Stop copying, editing, and saving
• Prevent or control printing
• Set an expiry date for your documents
• Create dynamic watermarks that include the user’s name and company (to prevent redistribution via printouts and photos)
• Revoke documents or users manually at any time, regardless of where the document is stored
• Lock documents to devices and locations
• Track who is opening and printing your documents, when, and from where

Here’s how to prevent a PDF from opening after download:

1. Right-click on a PDF file on your computer and select “Make Secure PDF”, then choose the DRM controls you want to enforce in Safeguard Writer.  Optionally, add a dynamic watermark that will display the user’s name.  This will deter them from taking pictures of the screen with a mobile phone or similar device.
   
2. When you press “Publish”, your secured PDF is saved to your disk as an encrypted file, and a document record is created on the Admin System.
   
3. You create a user account for each user you want to view your secured PDF by pressing “Add” in the “Customers” tab of your admin system.  An email is automatically sent to the user with a link to the Viewer and their license.
   
4. You upload the PDF to your website.  Only users who have a valid license file activated on their device will be able to open the PDF, and only in the secure viewer application.
   
   

   The best way to prevent download of PDFs from a web page

Locklizard provides a simple, effective, and cost-friendly way to secure PDF downloads from sharing and misuse. Rather than fruitlessly trying to stop the download from happening, it focuses on the desired outcome: the prevention of piracy and leaks.  Anyone can download a restricted PDF file, but only authorized users can open it.  This leads to both better security and a better experience for users, as they don’t need a persistent internet connection to view restricted PDF files.

To protect your PDF documents from unauthorized access, piracy and misuse, take a 15-day free trial of our PDF DRM software.

   FAQs

Is it possible to make a PDF non-downloadable?

Yes – you could achieve this by adding a very strong random password to the download link or cloud storage account and never sharing it.  However, as soon as you share the password with an untrusted party, you run the risk of them sharing it or the downloaded PDF with whomever they like.

How do I stop Adobe PDFs from being downloaded and printed?

There’s no good way to stop a PDF from being downloadable for some users and not others because browser-based controls just aren’t effective.  Adobe restrictions or permissions to prevent printing are also useless since they can be instantly removed.  Preventing printing for downloaded files is possible, however, by utilizing a PDF DRM solution such as Locklizard.

How do I make a PDF read-only?

By protecting it with Locklizard Safeguard as outlined in our guide, how to make a PDF read-only.

How do I allow viewing but prevent downloading of PDF files in WordPress?

There’s no way to do this effectively.  Though several WordPress plugins allow you to embed PDFs without a download button appearing (or the download button is disabled), there are numerous other ways for users to download your files, such as copy pasting, using the browser’s developer mode, screenshotting, etc.  More details about WordPress PDF security can be found at Using WordPress for secure sharing of PDF files.

What security settings prevent PDF download?

It depends on the application.  However, you must also prevent printing and copying to successfully prevent downloads and restrict opening after download to authorized users only.  If you also stop a PDF from opening in the browser, it will be much more secure: users cannot easily bypass security restrictions in a dedicated reader or viewer app.

Can you prevent someone from saving a PDF?

Yes.  Locklizard Safeguard DRM disables the save button to prevent saving to unprotected PDF files.  It also prevents users from copying content to another file for saving via copy and paste, file driver printing, and screenshots.

How do I protect a PDF from a screenshot?

By using DRM software that utilizes a device-installed viewer application, as browser-based screenshot controls are not effective.  Third-party screen grabbing tools or OS-specific ones such as Windows Snipping Tool can easily bypass browser screen grabbing restrictions.

Does WordPress prevent a PDF from opening after download?

No, once a user has downloaded a PDF anyone can open it.  This means it can be easily shared with unauthorized users.

Can you prevent PDF download in Moodle?

Just like SharePoint, Moodle has an option to prevent download of course content.  It can prevent download of PDFs and other file types.

However, it does not prevent printing or copying of content, so is effectively useless.

There are various Moodle plugins such as ‘Secure PDF’ that claim to prevent students from downloading courses by displaying the pages as images.  However, they can still be printed to PDF files and screen grabbed.  Displaying PDF files as images can also negatively affect users with poor internet connections since pages will take longer to display.

Is it possible to disable PDF download by disabling the download button?

Not effectively.  This is because JavaScript or JS is used to disable the download button.  Users can edit JS in their browser to change the functionality or load another plugin that uses JS to activate the download button.

Can you download a restricted PDF from Google Drive?

Yes, by printing to a PDF.  See Is Google Drive secure? for how to easily remove print restrictions.