Selling Digital Products with WooCommerce: Setup Guide

In WooCommerce a digital product is an ordinary simple product with the Virtual and Downloadable boxes ticked: you attach the file, decide how many times it can be downloaded and for how many days the link stays valid, and the customer receives it in the order confirmation email. The basic setup takes a few minutes.

The parts that actually matter are two others: where the files physically live, because the wrong folder makes them downloadable by anyone, and VAT, because digital services sold to private customers in the European Union are taxed at the customer's rate rather than yours.

Virtual and Downloadable: two boxes, two meanings

They are the most common source of confusion, because they look like synonyms and are not.

The most useful practical consequence concerns order statuses. When an order contains only virtual and downloadable products, WooCommerce moves it straight to "Completed" as soon as payment succeeds, without stopping at "Processing". That is the correct behaviour for a digital shop: there is nothing to prepare, so there is no reason to keep the order in a queue.

If the order also contains a physical product, the status stays at "Processing" until you ship. In that case, if you want the customer to download the digital part immediately, enable the option that grants download access right after payment, under Settings, Products, Downloadable products.

Setting up the product step by step

The procedure is the same as any simple product, with three extra fields.

1. Create the product and pick "Simple product" in the Product data box.
2. Tick Virtual and Downloadable. The Shipping tab disappears and the file fields show up.
3. Add the files in the General tab. Each row has a name, which is what the customer sees in the email, and a path. Use readable names: "Complete-guide.pdf", not "final_v3_def.pdf".
4. Set the download limit. Leave it empty for unlimited. A low value such as 1 generates support requests the first time someone changes device: if you want a limit, 3 or 5 is far more manageable.
5. Set the expiry in days. Empty means never. Careful: expiry counts from the order date, not from the first download.
6. Assign the tax class. Digital products need a dedicated class, as covered below, not the standard one used for physical goods.
7. Place a test order with a payment method in test mode and download the file from your customer account, not from the admin area. It is the only way to see what a buyer actually gets.

That last point is the one most often skipped, and it produces the most embarrassing failures: corrupted files, links pointing at an older upload, emails arriving with nothing attached because the path was relative.

Where files live and how to protect them

This is the technical point that separates a properly built digital shop from one giving its catalogue away.

When you upload a file through the WordPress media library, WooCommerce moves it into a dedicated folder inside uploads, called woocommerce_uploads, and writes an .htaccess file there to block direct access. That mechanism works on Apache. On Nginx the file is simply ignored, so the protection has to be written into the server configuration: without that step, anyone who guesses or receives the URL downloads the file without buying anything.

The second element is the download method, chosen under Settings, Products, Downloadable products. There are three options and they are not equivalent:

• Force downloads: the file is served through PHP and the real URL is never exposed. It is the safest option, but it consumes server memory and struggles with large files.
• X-Accel-Redirect/X-Sendfile redirect: PHP checks permissions, the web server delivers the file. This is the best combination, provided the module is enabled on your hosting. It is worth asking your provider.
• Redirect only: the browser is sent to the real file URL. Fast, but the address sits in browser history and can be shared. Avoid it for paid content.

One more recommendation: enable the option restricting access to logged in users if you sell high value material. It forces account creation, which adds friction at checkout, but ties each download to a verifiable identity rather than to a shareable link.

VAT on digital products: the expensive mistake

Digital products sold to private consumers fall under electronically supplied services, and they follow a different rule from physical goods: VAT follows the customer's country. An ebook sold to a German consumer carries the German rate, one sold to a Spanish consumer the Spanish rate.

There is a simplification threshold: while the yearly total of cross-border distance sales and digital services to other EU countries stays below 10,000 euro, you can keep applying your domestic rate to everything. Above that, or if you opt in voluntarily beforehand, you register for the OSS scheme and pay the VAT owed to other member states through a single quarterly return.

On the configuration side you need three things. First, a tax class dedicated to digital goods with per-country rates, kept separate from the physical goods class. Second, tax calculation set to the customer billing address, not the shop base. Third, evidence of location: the rules require two non-contradictory pieces, typically the billing country and the geolocation of the IP address, stored alongside the order. If your shop feeds an accounting or ERP system, this is exactly the flow worth checking when you plan integrations and API work, because cross-border digital orders are where mismatched tax data surfaces first.

Delivery, email and right of withdrawal

The customer gets the links in two places: the order completed email and the Downloads section of their account. If the email does not arrive, the product does not exist, so deliverability matters more here than on a physical shop where the parcel turns up anyway. Configure a dedicated authenticated sending service and test reception on at least three different mail providers.

On the legal side there is a point most shops handle badly. Consumers have fourteen days to withdraw, digital content included, and they lose that right only when two conditions apply together: they expressly consent to immediate performance and they declare awareness that this cancels the right. So you need a specific consent checkbox at checkout, separate from accepting the terms of sale, with wording that states both. A generic terms checkbox is not enough.

Common mistakes

• Uploading files via FTP into a public folder and pasting the URL into the product: the file stays accessible to anyone, forever.
• Setting the download limit to 1: every device change or interrupted download becomes a support ticket.
• Leaving an expiry active on products sold as "lifetime access": the link stops working and the customer is right to complain.
• Replacing a file by uploading a new one with the same name: earlier buyers may end up with a dead link. Update the file row in the product, not just the folder contents.
• Using Force downloads on files of hundreds of megabytes: the transfer breaks when PHP hits its maximum execution time. Large files belong on external storage with signed, expiring links.
• Testing only as an administrator: the admin account has permissions a customer does not, so a backend test proves nothing.

In short

Configuring a downloadable product takes five minutes, but a digital shop only stands up if three invisible things are right: files must be out of reach for anyone who has not paid, VAT must follow the customer's country, and consent to immediate performance must be collected explicitly at checkout.

When we build a digital online shop we start from those three, because they are the ones nobody notices until the first serious problem shows up: a file circulating for free, a tax audit, or a refund request you cannot refuse.