So I'm seeking to implement a downloads system and want to control the downloads so they are exclusive to a certain membership of users.

What steps should I take to secure my downloads?

Host all the files below the Public HTML (so their hidden) and pull up the files via file which confirms a timestamp is correct.

Essentially:

PHP Code:

<?php
$url_to_files = '\home\name\files\\';
$filename = $_GET['ID']; // should be number.
if($_POST['timestamp'] == $_SESSION['timestamp'] && is_readable($url_to_files.$filename.'php')){
// Include a file in that directory with data about the files and maybe some headers. 
include($url_to_files.$filename.'php'));
# below is an example of the file #
// it's a PDF
header('Content-type: application/pdf');
// force them to download
header('Content-Disposition: attachment; filename="filename.pdf"');
// Make it so the file is not cached
header("Cache-Control: no-cache, must-revalidate");
header("Expires: Sat, 26 Jul 1997 05:00:00 GMT");
// send em the file
readfile('filename.pdf');
unset($_SESSION['timestamp']);
} else {
echo "FAIL!";
}
?>

OMG

and get your site down on some dozens of concurrent requests

If you need to secure your downloads for a serious amount of requests you need to install something like nginx or lighhtpd as a frontend and setup it accordingly.

lighttpd of cource

Thanks rogem.

So application/pdf I replace pdf with whatever the file extension is? zip, rar etc?

And regarding lighthttpd etc, how neccessary is this?

Lighttpd is absolutely neccessary if you intend to have more than 100 users who may download at the same time, especially if your files are large enough.

Readfile() will try to read the whole file into memory and will not release it until the transfer is complete, so e.g. if 100 users will request a 10Mb file at the same time you will quickly lose 1G of memory which will quite definitely lead to swapping and probably to server stop responding at all.

You may replace readfile() with reading by blocks, but in this case you will have to support Range header (required for resuming downloads and parallel downloads) while lighttpd will handle it by design.