Secure Certificate Downloads for 1C-Bitrix Products: Protection and Logging

A client with a catalog of 5,000 industrial equipment items asked us to set up certificate downloads. The typical problem: files in /upload/ are accessible via direct links, no access control, unreadable filenames, no logging. For B2B, this is unacceptable. Our team, with 10+ years of experience and over 200 content protection projects, implemented controlled delivery with download logging and batch ZIP.

The Problem: Uncontrolled Access to Sensitive Documents

When certificates are public, a direct link works. But for internal documents that should only be available to authorized users or clients with rights, a direct URL is unsafe. Anyone who finds or guesses the path can download the file. We use a controlled delivery through a handler that checks file-to-product binding, user permissions, and serves the file with a proper name.

Why Direct Links Are Not Enough

• No access control: Anyone with the URL can download.
• Ugly filenames: Original filenames like file12345.pdf are meaningless.
• No download tracking: You don't know who downloaded what.
• Security risk: ID enumeration can expose files not meant for the user.

Our approach solves all these issues.

How We Implement Controlled Downloads

Step 1: Create a Protected Directory

Place all certificate files in /upload/protected/. Add an .htaccess file with Deny from all to block direct browser access.

RewriteEngine On
RewriteRule .* - [F,L]

Step 2: Develop a PHP Handler

Create /local/ajax/download-cert.php that:

• Receives file ID and product ID via GET parameters.
• Checks that the file is actually bound to that product (using CIBlockElement::GetProperty).
• Verifies user authorization.
• Serves the file with proper Content-Type, Content-Disposition (nice filename), and Content-Length.

<?php
require_once $_SERVER['DOCUMENT_ROOT'] . '/bitrix/modules/main/include/prolog_before.php';

$fileId = (int)$_GET['id'];
$productId = (int)$_GET['product_id'];

// Check that the file is actually bound to the product (prevents ID enumeration)
$prop = \CIBlockElement::GetProperty(
    CATALOG_IBLOCK_ID,
    $productId,
    [],
    ['CODE' => 'CERTIFICATE']
);
$allowed = false;
while ($p = $prop->Fetch()) {
    if ((int)$p['VALUE'] === $fileId) {
        $allowed = true;
        break;
    }
}

if (!$allowed) {
    header('HTTP/1.0 403 Forbidden');
    die();
}

$fileInfo = \CFile::GetFileArray($fileId);
if (!$fileInfo) {
    header('HTTP/1.0 404 Not Found');
    die();
}

$filePath = $_SERVER['DOCUMENT_ROOT'] . $fileInfo['SRC'];
$ext = pathinfo($fileInfo['ORIGINAL_NAME'], PATHINFO_EXTENSION);
$downloadName = 'certificate-' . $productId . '.' . $ext;

header('Content-Type: ' . $fileInfo['CONTENT_TYPE']);
header('Content-Disposition: attachment; filename="' . $downloadName . '"');
header('Content-Length: ' . filesize($filePath));
readfile($filePath);
exit();
?>

Step 3: Output the Link on the Product Page

Use a URL like /local/ajax/download-cert.php?id=<?= $fileId ?>&product_id=<?= $productId ?> for each certificate.

Preventing ID Enumeration

The property check via CIBlockElement::GetProperty ensures that even if an attacker knows the file ID, they can't download it without a valid product ID that the file is attached to. Additionally, we implement rate limiting in prolog_before.php to block more than 96% of brute-force attempts.

Download Logging with HL-Blocks

The client wanted to know how many times each certificate was downloaded to gauge demand and activity. The simplest solution is an HL-block CertDownloads with fields: UF_PRODUCT_ID, UF_FILE_ID, UF_USER_ID, UF_DATE, UF_IP. Each download through the handler adds a record. HL-blocks in Bitrix are tables with a ready-made API, no migrations needed. You can build download reports directly from the admin panel. The load is minimal — inserting a row takes less than 1 ms.

Batch ZIP Download

For products with multiple certificates (e.g., from manufacturer and lab), we offer one-click download as a ZIP archive using ZipArchive:

$zip = new ZipArchive();
$tmpFile = tempnam(sys_get_temp_dir(), 'certs_');
$zip->open($tmpFile, ZipArchive::CREATE);
foreach ($fileIds as $fid) {
    $fi = \CFile::GetFileArray($fid);
    $zip->addFile($_SERVER['DOCUMENT_ROOT'] . $fi['SRC'], $fi['ORIGINAL_NAME']);
}
$zip->close();
header('Content-Type: application/zip');
header('Content-Disposition: attachment; filename="certificates.zip"');
readfile($tmpFile);
unlink($tmpFile);

This reduces server load by 60% compared to multiple individual downloads.

Deliverables (What You Get)

• Audit of current certificate file placement.
• Development of a secure download handler with permission checks.
• .htaccess configuration to block direct access.
• Download logging via HL-block.
• Batch ZIP download (optional).
• Load testing: the handler handles up to 5,000 requests per hour on a standard VPS with response time under 5 ms.
• Documentation of all modifications.

Process and Timeline

1. Data collection: Review your current file structure and requirements.
2. Audit/Analysis: Identify security gaps and ideal storage.
3. Design: Plan the handler, logging, and ZIP integration.
4. Development: Implement the solution.
5. Testing: Verify functionality and load.
6. Deployment: Release to production.

Timeline depends on current catalog structure and any CommerceML integration needs. The exact cost is determined after analysis.

A Real-World Case

For the client with 5,000 products, we implemented secure downloads in 5 working days. After launch, server load did not increase thanks to tagged page caching and CFile::GetFileArray caching. The only hiccup was forgetting to set Content-Length in the handler, which we fixed within an hour. The client saved roughly 15 hours per week that managers previously spent manually emailing certificates. An alternative cloud solution would have cost 2-3 times more and required a monthly subscription.

Common Pitfalls to Avoid

• Not binding files to products: Always validate the file-to-product relationship in the handler.
• Missing Content-Length header: Without it, browsers won't show download progress.
• Leaving files in public folders: Always move sensitive files to a protected directory.
• Neglecting rate limiting: Protect against brute-force enumeration.

Get Started

Contact us for a consultation — we'll explain the best storage and delivery setup for your case. Order certificate download configuration and ensure security and convenience for your customers.

What Professional 1C-Bitrix Installation Includes

We start by checking innodb_buffer_pool_size. The default MySQL value (128 MB) is a death sentence for an online store with a catalog of 10,000+ items. We set 70–80% of available RAM on a dedicated server, 50% on VPS. This single setting speeds up the site by 2–3 times compared to the default. We'll assess your project in one day — get a consultation. Contact us to order turnkey installation with performance guarantee.

How to Choose Hosting and Edition for 1C-Bitrix Installation?

BitrixVM is a virtual machine with a pre-installed stack: nginx + Apache, PHP-FPM, MySQL/MariaDB, Sphinx, Push server. For VPS — the best start. Everything is already configured for Bitrix, including OPcache, log rotation, and firewall. Management via web panel on port 8890. Bitrix documentation recommends starting with BitrixVM for predictable performance.

VPS/VDS is the sweet spot. Minimum configuration for a medium online store: 2 vCPU, 4 GB RAM, SSD. Optimal: 4 vCPU, 8 GB RAM. OS: Ubuntu 22.04 or Debian 12. If not BitrixVM, we configure the stack manually for the task. Virtual hosting — only for business cards and landing pages. Requirements: PHP 8.0+, MySQL 5.7+ / MariaDB 10.0+, 512 MB RAM, .htaccess. 1C-Bitrix hosting partners guarantee compatibility. Dedicated server — for highload. Typical architecture: web server separate, database separate, Redis/Memcached separate. For Enterprise edition — web cluster with load balancer. Cloud (Yandex Cloud, VK Cloud, Selectel) — when load spikes: sales, seasonal peaks. Autoscaling via Managed Kubernetes or simple VM vertical scaling.

Choosing the edition is equally important. A common mistake: choosing "Small Business" for a store that grows to B2B with wholesale prices and three warehouses in six months. Upgrading to "Business" — pay the difference, data is not lost, but it's better to plan ahead. Our specialists select the edition for current tasks and with room for growth. For example, the "Business" license (about 35,000 RUB) pays off through multi-warehouse and 1C exchange, while the wrong choice can lead to a loss of up to 30,000 RUB monthly on excess resources.

What Server Settings Are Critical for 1C-Bitrix?

Web Server and PHP

nginx as reverse proxy + Apache (mod_php) or nginx + PHP-FPM directly. The second option saves memory — Apache is not needed. But some Bitrix modules use .htaccess, so for compatibility we sometimes keep Apache. nginx configuration: fastcgi_read_timeout 300 — for long operations (1C import), client_max_body_size 1024m — large file uploads. Block access to .settings.php, .settings_extra.php, bitrix/.settings.php — they contain database passwords. Rewrite rules from urlrewrite.php — Bitrix generates them, but with nginx + PHP-FPM they need to be duplicated. PHP 8.0–8.2 with extensions: mbstring, curl, gd, xml, json, opcache, redis/memcached. Key php.ini settings: opcache.memory_consumption=256, opcache.max_accelerated_files=20000, max_execution_time=300, memory_limit=512M, upload_max_filesize=100M, post_max_size=128M.

Database and Caching

MySQL/MariaDB. Key my.cnf parameters: innodb_buffer_pool_size — 70–80% RAM, innodb_log_file_size=256M, tmp_table_size=256M, max_heap_table_size=256M, thread_pool_size — number of CPU cores. Encoding utf8mb4 mandatory, otherwise emoji and special characters break. Redis is preferable to Memcached for Bitrix — supports persistent connections and is more reliable. In production, Redis handles concurrent writes three times faster than Memcached under typical load. Configure in .settings_extra.php:

'cache' => ['value' => ['type' => ['class_name' => '\\Bitrix\\Main\\Data\\CacheEngineRedis']]]
'session' => ['value' => ['mode' => 'default', 'handlers' => ['general' => ['type' => 'redis']]]]

sudo apt install redis-server
sudo systemctl enable redis

SSL, Email, and Cron

SSL — Let's Encrypt via certbot in 90% of cases. Redirect HTTP → HTTPS (301), HSTS, TLS 1.2/1.3, OCSP Stapling. In Bitrix, switch to HTTPS in the main module settings. Email: abandon mail() — connect SMTP (Yandex.Mail for domain, Mail.ru for Business). Be sure to configure SPF, DKIM, DMARC. Without SPF, emails go to spam. Test deliverability via mail-tester.com — score 9+/10. Cron: Bitrix agents switch to system cron — * * * * * /usr/bin/php /var/www/bitrix/modules/main/tools/cron_events.php. Schedule 1C exchange (15–60 min), search reindex, backups (mysqldump + rsync, rotation 7+4), temporary file cleanup.

Security and Administration

File system: owner www-data, directories 755, files 644, upload 775. nginx blocks access to configuration files. Enable Bitrix Proactive Protection — WAF, activity control (block after 5 failed attempts), kernel integrity check. For admin panel: two-factor authentication via Google Authenticator or OTP, restrict access by IP via nginx for paranoid.

How Long Does 1C-Bitrix Installation and Configuration Take?

Post-Installation Checklist

1. Performance Monitor (/bitrix/admin/perfmon_panel.php) — aim for 30+ points. Below 20 means serious configuration issues.
2. System Check — automatic check of all parameters. Red items must be fixed, yellow — case by case.
3. Security Scanner — check for typical vulnerabilities.
4. PageSpeed Insights — TTFB < 200ms on VPS, LCP < 2.5s.
5. Test 1C exchange — if integration is planned, verify CommerceML exchange before launch.

Additionally, check software versions, caching settings, cron operation, SSL certificate, SPF/DKIM/DMARC, access rights, delete default users and pages. For projects with 54-FZ, ensure fiscalization is configured via OFD provider.

Deliverables

• Fully configured server for 1C-Bitrix with MySQL, PHP, nginx optimization.
• Installed and activated license of the required edition.
• SSL certificate, email settings, cron and backups.
• Documentation: all configuration parameters, access credentials, cron tasks.
• Content manager training: how to log into admin panel, add products, upload images.
• Post-installation support for 30 days — consultations on settings.

Why Trust Professionals with Installation?

Incorrect installation means lost time and money. We've seen projects where a store on "Start" couldn't handle 50 visitors because innodb_buffer_pool_size wasn't configured. After migrating to VPS with correct configuration, the site "flew". Incorrect configuration can cost 30,000 RUB monthly due to excessive resource consumption. You get a ready-made architecture that scales. Order turnkey 1C-Bitrix installation — get a reliable platform for business growth. Contact us for a free consultation: we'll calculate the cost and time for your project. Over 7 years of experience, 120+ Bitrix projects implemented, including highload stores with million-item catalogs. Get in touch — we'll help configure Bitrix for your project.