Yusuf Odukoya

They are bot downloads, or downloads from an external websites that are hotlinking to your files.
Solution:
You can use a cloudflare security WAF rule to block URI requests that contain the word “wpdmdl” and does not have a cookie that contain the word “wp”.

I’ll request permission to share the links from my team. Thanks.

I know all of that. Exactly what I did but it gives different behaviors at different times.

I am talking about inconsistency here.

Here’s it:

Sometimes, downloading single files works as expected, while other times, it just downloads any file it pleases. The latter is the result in most cases.

Or sometimes, it just downloads the whole ZiP file when you choose to download a single file.

I had to temporarily disable single file downloads, now my users have to download the full ZIP file in order to mitigate such unpredictable behavior.