Fileflare gives you four levers to control how often and from where customers can download their files: a per-link download count, a per-link IP address limit, an order-level expiration date, and an auto-block on fraud-flagged orders. Stack them as needed for your protection level.
Each setting is gated to a different plan tier. Asset download limits are free; order expiration needs Basic; fraud auto-block needs Growth; IP limits need Premium. All four are configured globally in Settings → Limitations, with per-order overrides available.
When you’d use this
- You’re seeing leaked copies of your files online and want to make sharing harder.
- You sell licensed content where each buyer should access from a small set of devices.
- You want orders to expire after a window so old links don’t accumulate.
- You want Shopify-flagged fraud orders blocked automatically rather than triggering chargebacks.
General guidance
Limits are always a tradeoff between protection and support load. A few things to keep in mind:
- Some customers’ connections fail and they need a couple tries to download.
- Many customers want files on both their phone and desktop — that’s two IPs minimum.
- Mail-server bots and antivirus tools sometimes pre-fetch links, consuming a download or IP slot before the customer touches it.
- Recommended floors: download count ≥ 2, IP limit ≥ 2 or 3.
The four limits
Asset download limit
Caps how many times each download link can be clicked. Per-link, per-asset.
Example: Limit = 2. A customer can click each link twice before it’s blocked.
Bots can consume clicks. We have systems that try to filter bot traffic, but it’s not 100%. Set 2-3 as a floor.
iOS previews don’t count. When an iPhone or iPad shopper opens a file, Safari often previews it inline before they actually save it. Fileflare recognizes those automatic preview fetches and doesn’t count them against the limit — only a real download (a save) uses up a click. So an iOS buyer who peeks at a PDF and then saves it spends one download, not two.
Plan: Free and above.
Order expiration (days)
Sets a number of days from the order date after which all download links on that order expire. Customers see your “expired” message (configurable — see restriction messages) when they hit an expired link.
Example: 3 days. Customers can download in the 72 hours after the order, then links go cold.
Plan: Basic and above.
Block fraudulent orders
Reads Shopify’s fraud analysis (medium / high risk) and blocks downloads on flagged orders automatically. The order also won’t fulfill in Shopify admin until you manually unblock.
Example: Block on High-Risk only. Medium-risk orders deliver as normal; high-risk orders are quarantined for review.
To unblock a flagged order you’ve verified is genuine: open the order in Fileflare and click Unblock access on the Access & limits card, then click Resend email to send the download email. See Block downloads.
Plan: Growth and above.
IP address limit
Caps how many unique IP addresses can access each download link. Per-link.
Example: Limit = 2. Each link can be hit from up to 2 different IPs before blocking. Good for “phone + desktop” use cases without enabling broad sharing.
Why ≥ 2 is recommended:
- Customers commonly download on both phone and desktop, each with its own IP.
- Antivirus and email-scanning tools sometimes hit links before the customer.
- Mobile / public networks have dynamic IPs that change between sessions.
Plan: Premium.
Allow downloads on pending payments
By default, Fileflare waits for the payment before it delivers anything. The Allow downloads on pending payments toggle in Settings → Download Control → Global limitations releases the order while it’s still in a pending payment state — and it governs the whole delivery, not just download access: the download links, the delivery email, and the Shopify fulfillment all follow the same rule.
This is useful for stores that use payment methods where confirmation lags the order — bank transfers, cash on delivery, manual payment methods, delayed-capture credit cards, or net-terms invoicing. With the toggle off, all three wait for capture: the customer sees their order placed, no delivery email goes out, and the order isn’t fulfilled in Shopify until the payment reports as paid. With it on, all three happen as soon as the order is created.
The trade-off is wider than it used to be: customers receive their files, the email announcing them, and a fulfilled Shopify order before the payment clears, so weigh it against your fraud and chargeback risk. The setting is off by default and you can flip it back at any time. Refunded and cancelled orders are still excluded, and fraud auto-blocking still halts a flagged order, so this isn’t a permanent grant — just an earlier window of access.
Override limits for a single order
When a customer legitimately needs more than the global limit (lost files, IP changed, bot ate their clicks), you can override the limits on their specific order without changing the global default.
Open the order in Fileflare and tick Override defaults on the Access & limits card. The card summarizes the limits actually in effect before you touch anything, and the fields seed from those same numbers — so turning the override on never changes what the customer can do, it just makes the numbers editable. Full walkthrough in Reset download limits for an order.
You can also cap a single file rather than the whole order: open the ⋯ menu on any row in the Downloads card and choose Set download limit.
Customize the messages customers see
Each restriction has its own message that displays to customers — expired, limit reached, blocked, fraud-restricted. Customize them in your voice (and add a “Contact us” button if you want) — see Customize restriction messages.
Tell customers about your limits up front
Reduces support load: a customer who knows the limit before clicking is less surprised when they hit it. Add a note in:
- Your download email template.
- The download box on the thank-you page and customer-account order page.
Common issues
- Customer hit the limit on their first click — usually a mail-server scanner or antivirus tool pre-fetched. (iOS Safari previews are already excluded and won’t cause this.) Confirm it in the order’s activity timeline — expand the download row and check the IP and user agent — then override their limit on the order.
- Limits feel too tight but I want protection — set 3 downloads + 3 IPs as a starting point. Most legitimate buyers fit comfortably; the genuinely abusive cases stand out.
- Fraud-blocked order should have been delivered — click Unblock access on the order’s Access & limits card, then click Resend email to send the download email.
- A limit field is greyed out with a lock next to it — that limit isn’t on your plan. Click the lock and Fileflare names the plan that unlocks it. Downloads per asset is editable on every plan.
- Forbidden / restriction messages can’t be edited — the body text is editable in Settings » Global limitations. The page styling itself isn’t editable; it inherits your Shopify theme.