Help with protecting pdf files

[BigDMorris]

What I do is put the files into a fold that has no links to it. Doesn't matter
if it's inside the site or above it. Next, after authenticating the user, you
copy the one file he is authorized to see into a TEMP folder and give the file
a temporary, very long, random filename and provide a hyperlink to that file.
This prevents him from rummaging through the temp folder trying different
filenames until he gets a hit. Then you crank up a scheduled task that daily
deletes all files that have been in the temp folder more than 24 hours.

[jmoshier]

The way we ended up solving this problem was using the cfheader and cfcontent
tags with a display.cfm page that pushed the actual path to the file into the
<href> tag of the link. Our customers never see the path to the file we are
protecting.

All you files can be in a folder anywhere inside your site.