What Shopify Digital Downloads Still Can't Do in 2026

The Shopify Digital Downloads app sits at 3.5 stars on the App Store, has not shipped a meaningful feature in more than four years, and in September Shopify quietly renamed it from Digital Downloads to Digital Products. The rename fixed exactly zero of the six gaps I keep finding when I audit stores that sell files for a living. This piece is what those gaps look like from an audit chair, in the order I usually find them.

I am writing this now because two of them - the August 26 checkout change and the card testing pattern - are actively costing merchants money this month, and both fixes are the kind of thing you can do yourself if you know where to look.

If you sell files and haven't opened Settings > Checkout > Customize since the last week of August, there is a good chance your customers no longer see their download link on the Thank You page. The email path still works. The block on the confirmation screen is gone.

August 26 was the deadline for non-Plus stores to migrate off the legacy checkout customization surface. On that day, Shopify replaced the old editor with the new checkout blocks system and did not carry over the block the Digital Downloads app injects. Anyone who used the February 2025 fix - the one that got you past the earlier checkout bug where the widget stopped appearing after installing the app on an upgraded checkout - had that fix silently invalidated.

The re-fix is the same underlying action in a different UI. In your admin, go to Settings > Checkout, click Customize, switch the page dropdown at the top from Checkout to Thank you, click the plus icon on the left, and add the Digital Downloads block. Save. Repeat for the Order status page separately. Then place a test order at $0 with a discount code and verify the link is on the confirmation screen.

If the Digital Downloads app does not appear in the block list, its Checkout Extensibility extension has not been updated for the new editor yet. Email delivery still works, so you are not down; you have a customer waiting for an email that used to be a link on the screen they were already looking at. That gap is real. On a shopify digital downloads store I audited last week the merchant only noticed after a customer sent a support email asking for the file.

Anyone with the download URL can grab the file

The download links the native app hands out are not authenticated. There is no session check, no token that ties the URL to the order that generated it, no way to invalidate a shared link. Anyone who receives a forwarded email, or a screenshot of a URL, or scrapes it out of a chat log, can download the file.

This is not new. A Shopify Community thread from before 2024 has a merchant testing the link on a friend's computer - different device, no login - and confirming the file downloads. No Shopify Staff has ever posted in that thread. No platform-side fix has appeared in the years since. It is the shipped behavior of shopify digital downloads and has been the shipped behavior for as long as I can remember.

For selling a $5 wallpaper pack, this rarely matters. For selling a $79 Canva template bundle that gets emailed around a design agency Slack, it matters a lot. If the file needs to be tied to the buyer, the native app is not the tool. Filemonk, Sky Pilot, and Big Download all issue signed URLs with expiration; that is the feature you are paying them for. What you get on the native app is a URL that a search engine could index if it were ever exposed on a public page.

PDF stamping still needs a paid app or your own server

PDF stamping - writing the buyer's name or email onto the file at download time - is the single most-requested feature I hear from merchants selling ebooks and templates. The shopify digital downloads app has no native stamping option. It has never had one. A community feature request from October 2025 asked Shopify to add stamping, watermarking, and basic DRM; a community moderator replied with the phrasing that first-party apps "are always feature limited," which is a polite way of saying not any time soon.

The paid options as of this month, in the order I actually recommend them:

Big Download includes PDF stamping and watermarking on the higher plans and has been the community favorite for large catalogs. Confirmed by several r/shopify commenters this year, including one who switched off SendOwl after the last price increase.
Filemonk added PDF watermarking in July 2025 on the Lite plan and up ($10 a month, 10 GB of storage). The Lite plan lets you configure buyer name, email, and purchase date as Liquid variables, choose fonts, placement, and opacity. Watermarking works only on files uploaded to Filemonk's own storage, not on files hosted elsewhere. If your files sit on Shopify's CDN today, you re-upload to switch.
PDF Products Pro exists, per its own developer's posts in the Shopify Community feature-request thread. I have not personally audited a store running it, so I cannot tell you how it feels past setup.

There is also a DIY path a developer named vladeta documented in an r/shopify thread in August: files in AWS S3 or Cloudflare R2, an orders/paid webhook that mints a signed URL with an expiry, and a small service that writes the buyer's email onto the PDF at download time. It is not as much work as it sounds if you already know your way around a webhook. It does require you to own the ongoing maintenance of that service. For a merchant tired of watching the app subscription line reprice every year, the trade is often worth it.

Card testing lives on your $1 products, and Shopify Protect is not coming

Digital product stores get hit harder by card testing fraud than physical ones do. The reason is mechanical. Card testers want to know whether a stolen card number authorizes. A $0.99 downloadable with instant delivery is a perfect probe: it authorizes, the fulfillment fires, and the tester has confirmation the card works. No shipping, no address matching, no fraud risk on their side. One shopify digital downloads merchant on r/shopify this year described getting 50 to 60 card-testing orders per day on their store.

Shopify Protect does not cover digital orders. I have seen this misunderstood so many times I now check for it in every digital audit. If you sell a downloadable, and it charges back, Shopify Protect will not reimburse you and you will owe the $15 chargeback fee on top of losing the order value. This is documented in Shopify's own community wiki for the Digital Products app; I have not seen it stated anywhere in the merchant admin itself.

The mitigations are the manual controls: turn on manual payment capture in Settings > Payments > Payment authorization, pause auto-fulfillment on the specific product under attack, and consider raising the price of anything under $5 until the burst passes. If you want a second look at your fraud settings before Black Friday, the first 15 minutes with a help1 expert is free and this is exactly the kind of check we are fast at.

The r/shopify community is genuinely split on whether to proactively refund suspicious orders before the chargeback arrives. Half the commenters swear the refund prevents the chargeback; the other half argue the chargeback comes anyway and the refund costs you the money twice. I do not have data either way and I will not pick a side without it.

The chargeback that costs you 80% of a course

For merchants selling courses or gated content - the small-creator segment that sits in the middle of help1's audience - the meanest chargeback pattern is what an r/shopify commenter this year called friendly fraud. Customer buys the course. Logs in. Downloads the materials. Emails you asking questions about lesson three. Six months later, disputes the charge and claims they never received access.

The seller who posted that story submitted login records, module completion percentages, timestamps of the customer's activity, and email correspondence. They still lost the dispute. Their bank did not care about usage evidence. What banks care about is proof of access granted: the delivery email timestamp, the download link, and any recorded acceptance from the customer that the product was received.

The counter-move I have seen work on more than one shopify digital downloads store: require a checkbox at first access where the customer confirms they have received the product before the module page opens. One commenter said that timestamp alone had won them two disputes. It is not free to implement - either the app you use supports it or you build a small piece of Liquid on the course page - but the cost is a one-time build, and the dispute win covers it the first time it fires.

What I actually put on stores now

For a small catalog of maybe 20 to 30 files, priced above $5, no stamping needed, no card-testing pattern in the data yet: the native app is fine. Use the widget fix above, treat email delivery as your real path, and do not buy a solution to a problem you do not have.

For a catalog past 50 files, or any store that has ever caught a card testing burst, or any merchant selling templates that get reshared: I move them off the native app. Filemonk if they want flat pricing and do not need bulk API scripting. Big Download if they need the API and stamping in one place. Sky Pilot if the customer-account library page matters to them (Shopify's own roadmap has a native version of that coming this year per Shopify Staff on a September community thread, but "on the roadmap for this year" is not the same as shipped, and I would not build a launch plan around it).

For anyone spending more than $50 a month across a stack of delivery, membership, and fraud apps: the app-cost question is worth its own audit. I wrote about the same shape of problem in the piece on paying too much for Shopify review apps; the mechanic is identical for delivery.

The pattern behind all six gaps is the same one. The native app was good enough at 20 products and became a liability at 200, and the investment signal Shopify has given - a rename, a rebrand, and roadmap language - is not the same as fixing it. If you sell files for a living, plan for the third-party layer as part of your Shopify stack the same way you plan for shipping labels; the platform is not going to catch up to you.