You could have placed the files in a directory outside the reachable parts for the web.
Then use the suggested
download function to retrieve the file, in that way nobody will be able to fetch it, only knowing the filename, since the folder is outside the "webscope"