No, I'm not talking about the .htaccess, rather a real (PHP) script that acts like some kind of proxy for the download.
The download request is sent to the script (let it be "download.php" with an ID of the reqiested file, the script then checks if everything is in order and sends the contents of the requested file to the browser.
This way you have absolute control over your downloads (you also can do some traffic checking) and the real location of the files is never revealed, the actual files can even be outside of the public accessible folder of the webserver