I recently produced the first release of the Webform Protected Downloads module that is compatible with Drupal 10. It provides the ability for sites to have 'gated' content which users can download once they have filled out a form for their details. This can convert engaged visitors into leads, set up licenses for customers, or simply validate a user for access to a file. Put simply, as the project's description says, this module could be useful to you if:

• You want to offer some files for download to either anonymous or registered users
• You don't want those files to be publicly accessible
• You want to collect some data before granting access to the files
• You want to be sure that the user gives a valid email address

One of our clients recently came to us with requirements along these lines for their Drupal 10 site, so I went out looking for suitable solutions. There are several similar modules, but this was the only one that fit these specific needs:

1. There should be no way for the public to access the files without completing the webform.
2. There could be more than one file to provide access to from a webform.
3. The file(s) should be downloaded from the website rather than sent by email.

We had used the module on an old Drupal 7 site a long time ago, but there hadn't been any work on it for a few years and there was no release compatible with Drupal 10. However, development had started in a branch that had been automatically opened up to new maintainers. This was a great example of how that process can help the community keep modules up-to-date and secure with little fuss. All I had to do was confirm a few details myself, and within a few hours I had access to update the project. Of course, I'm building upon the great work that has been done by the previous maintainers - and in this case, Timotej Lovrecic especially, who had created an initial fork on GitHub that was compatible with Drupal 8.

Now that we have a version to use with Drupal 10; let me introduce you to how to use it! I'll assume you can already download and install the module. 

Screenshot of the handler settings (click image for full size)

When you configure the settings of a webform, you can set up 'handlers'. Emails sent to users or administrators are probably the most common sort of handler, so the tab to configure these under Webform's 'Settings' page is labelled 'Emails / Handlers'. Add a handler, and choose the 'Webform protected download' type in the popup.

From here you can control what amount of verification you want to apply to the download link (such as whether you want to restrict it to the user that submits the form or not), whether the link should only work once, or expire after some time. The file to protect can be uploaded at the bottom of the form. 

Once you've configured and saved your handler, the next step is to use tokens to set how a user receives their link. These could go in an email - in which case configure an email handler, or a confirmation message/page - which can be set from the 'Confirmation' tab of the Webform's 'Settings' page.

In either case, the token to use takes the format: [webform_submission:protected_download_url:my_handler_id]. (If you only have one protected download, you can skip that last part off so it is just [webform_submission:protected_download_url].) The handler ID should be the 'machine name' from your handler settings, which is also shown in a column in the list of handlers. The token will be replaced with the user's unique download URL, so you may wish to use it directly within a plain-text email, or as a link destination in a confirmation message (which is usually HTML).

Example of using a download token for a link within the confirmation message

With that token in the right place, when your guest completes the webform, they'll now receive the link to download the file they wanted - and you'll have what you wanted in return.

Let me know how you get on. Your feedback is welcome in the comments below or in the Webform Protected Downloads module's issue queue!