Wait, there's also obfuscation techniques. Maybe using JavaScript to generate the actual link on the client side through scripts. That way, the real link isn't visible in the HTML source. But that might not be reliable for all users, especially those with JavaScript disabled. Alternatively, using a server-side solution where the user clicks a link that goes to a script on the server which then handles the download from a database. The server can log access or enforce some rate limits.