Wordpress wp-content uploads folder security

I have a website where users can upload digital products and I do not want just anyone to be able to download them, they have to have purchased the product (or the product is listed as free).

I hold the downloadable file locations in custom post meta - and I have a .php script which the user is diverted to which downloads the file if they have purchased it, or if it's free... it needs a small addition though in having the .pdf download "forced" but I am hoping I can accomplish this myself.

The force_download.php checks a database for a user and if they have paid for a product, if they have it triggers a header(location:file)

I have removed the indexes in my .hta file (I'm running Apache), I just want to be sure that the contents of my wp-content/uploads/yyyy/mm are not downloadable by other means, can someone advise me whether the controls I have in place are enough?