Have a script that makes a call to a location below the web root. Or you can .htaccess it to deny all, leaving your server the only thing that can access it. I could be wrong,. but I believe there is no way to download a file that is below the web root unless the script has it do so.

__________________