Did you write your download.php script? If so, open it up and put this in the file:
PHP Code:
<?php
if( isset( $_SERVER['HTTP_REFERER'] ) &&
!strpos( $_SERVER['HTTP_REFERER'] , $_SERVER['HTTP_HOST'] ) ){
die('leecher!');
} else{
// Current contents of download.php, in their entirety
}
?>
Where it says
// Current contents of download.php, in their entirety, replace that comment with all of the code currently in the download.php file. This way if someone gets to the download script without being refered by a page on your site, they will be refused access.