contaolabs / contao-email-download

1.0.1 2026-10-21 14:45 UTC

Requires

• php: ^8.1
• contao/core-bundle: ^4.13 || ^5.3
• doctrine/dbal: ^3.3 || ^4.0
• symfony/config: ^5.4 || ^6.4 || ^7.0
• symfony/dependency-injection: ^5.4 || ^6.4 || ^7.0
• symfony/http-foundation: ^5.4 || ^6.4 || ^7.0
• symfony/http-kernel: ^5.4 || ^6.4 || ^7.0

Requires (Dev)

• contao/manager-plugin: ^2.0

Conflicts

• contao/manager-plugin: <2.0 || >=3.0

MIT

• contaolabs

• pdf
• download
• contao
• e-mail
• lead
• gated content
• lead magnet

Published on Packagist.org on 2026-10-21 14:48 UTC

README

Download for e-mail address – free extension by contaolabs.

Deutsche Anleitung

Visitors enter their e-mail address and receive a download link by e-mail, for example for a PDF, a checklist or a ZIP file. The link expires after a set time and can only be used a few times. The file itself stays protected: it has no public address.

Works with Contao 4.13, 5.3 and 5.7 · PHP 8.1 or newer · MIT license

• Product page and live demo: contaolabs.de/erweiterungen/contao-email-download
• Source code and issues: github.com/contaolabs/contao-email-download

Features

• Front end module "Download for e-mail" with introduction, optional info banner, e-mail field and consent checkbox
• Built-in e-mail sending, no Notification Center needed: subject and text are set in the module, placeholders ##link##, ##file##, ##expires##, ##max_downloads##, ##email##
• Protected download via /_email-download/<token>: expiry date, maximum number of downloads, no direct file link. Only a hash of the token is stored in the database.
• Back end list "Content → E-mail downloads" with filter, search and CSV export (UTF-8, opens correctly in Excel)
• Requests are deleted automatically after a configurable number of days (daily cron job)
• Spam protection without captcha: honeypot, request token, rate limit per IP address and per e-mail address
• Accessible: labels, error messages linked via aria-describedby, status message receives focus
• German and English translations

Requirements

Contao	4.13, 5.3 or 5.7
PHP	8.1 or newer
E-mail	a working Contao mailer configuration (MAILER_DSN)
Cron	Contao cron (web cron or contao:cron) for deleting old requests

Installation

Contao Manager: search for contaolabs/contao-email-download, install it and update the database. Alternatively upload the ZIP file from the product page under "Upload packages".

Composer:

composer require contaolabs/contao-email-download
vendor/bin/contao-console contao:migrate

Setup

1. Put the file into a non-public folder below files/ (folder setting "Public" not checked). The module shows a notice if the selected file is in a public folder.
2. Create a module of the type Download for e-mail under Themes → Front end modules and select the file.
3. Adjust the texts, banner, sender and e-mail text as needed. Empty fields use sensible default texts in the language of the page.
4. Include the module on a page (content element "Module" or page layout).
5. Describe the download in your privacy policy (see Privacy).

Module settings

Field	Default	Description
File	–	File that is sent as a link. Use a non-public folder.
Link valid for (hours)	72	How long the download link works.
Maximum downloads per link	5	How often the link can be used.
Introduction	–	Text above the form.
Consent text	default text	Text next to the required checkbox. Links are allowed, e.g. <a href="{{link_url::12}}">privacy policy</a>. The text is stored with each request.
Button label	"Send me the download link"
Success message	default text	Shown after submitting.
Show info banner	off	Box above the form with title, text, link and link text.
Sender address / name	website administrator / page title	Taken from the website root if empty.
Subject / E-mail text	default text	Placeholders see below. If ##link## is missing, the link is appended.
Delete requests after (days)	90	0 = never delete.

Placeholders in subject and e-mail text

Placeholder	Content
##link##	Download link (absolute URL)
##file##	File name
##expires##	Date and time until the link is valid
##max_downloads##	Maximum number of downloads
##email##	E-mail address of the visitor

How the download works

1. The visitor submits the form. The module creates a request with a random token and sends the link https://example.com/_email-download/<token>.
2. On click, the token is checked: does it exist, has it not expired, is the download limit not reached? Then the file is sent as an attachment (Cache-Control: no-store, X-Robots-Tag: noindex).
3. If the link has expired, has been used up or is unknown, the visitor is redirected back to the form page and sees a notice there. If that page no longer exists, a simple page with HTTP status 410 is shown.

The same e-mail address can request at most 3 links per hour, one IP address at most 10. Additional requests from the same e-mail address see the normal success message, but no e-mail is sent, so the form does not reveal which addresses have been used.

Back end

Content → E-mail downloads lists all requests with e-mail address, date, expiry, downloads and the consent text. The button "Export CSV" downloads all requests as a CSV file (semicolon separated, UTF-8 with BOM).

Customizing the appearance

The default style is neutral and uses CSS variables:

.cl-edl {
  --cl-edl-accent: #2f66e0;      /* button */
  --cl-edl-border: #cfd6e4;
  --cl-edl-radius: 12px;
  --cl-edl-banner-bg: #f3f5fc;
}

For bigger changes, copy the template mod_cl_email_download into the templates folder of your theme. The stylesheet is bundles/contaolabsemaildownload/email-download.css.

Privacy

Stored per request: e-mail address, time of the request, expiry, number of downloads, the consent text at the time of the request and the page. The IP address is only stored shortened (IPv4 /24, IPv6 /48) and hashed, for the rate limit. Requests are deleted after the configured number of days.

Example for your privacy policy (please adapt it to your website):

If you request a download via our form, we process your e-mail address to send you the download link (Art. 6 (1) (b) GDPR). We store the request with the time and number of downloads and delete it after [X] days.

This extension is not legal advice. If you want to use the addresses for marketing as well, you need a separate consent for that, e.g. an additional newsletter checkbox with double opt-in.

Troubleshooting

• No e-mail arrives: check the Contao system log ("An e-mail has been sent to …") and the spam folder. Check the mailer configuration and whether SPF/DKIM are set up for the sender domain.
• "The download is currently not available": the selected file no longer exists. Select it again in the module.
• The file is accessible without e-mail: the folder is public. Uncheck "Public" in the file manager.
• Old requests are not deleted: the Contao cron does not run. Enable the web cron or run vendor/bin/contao-console contao:cron regularly.

Support

Questions and bug reports: GitHub issues or [e-mail]. More extensions for Contao and Isotope: contaolabs.de

License

MIT – see LICENSE.