SSL certificate, upload, location, destination,

Protecting the uploads is not part of Gravity Forms. However, you can do a couple things:

1. You can force all access to the upload folder to be via https/SSL by adding this to your .htaccess file:

RewriteEngine On
RewriteCond %{SERVER_PORT} 80
RewriteCond %{REQUEST_URI} wp-content/uploads/gravity_forms
RewriteRule ^(.*)$ https://example.com/wp-content/uploads/gravity_forms/$1 [R,L]

That will work if your host allows that type of override in an .htaccess file. That will force any access to that folder via http to be redirected over https. That protects the request during transit.

2. You can change the upload directory with the gform_upload_path filter: http://www.gravityhelp.com/documentation/page/Gform_upload_path That will put uploads into a new directory for you. If you do that, the information in item 1 above will need to be adjusted to the new location and URL.

3. However, none of that will prevent someone with the URL from accessing the document directly. They would just be directed to a secure connection and the download would continue. You can however, protect the upload directory with Apache Basic Authentication, which will force the visitor to log in with a username and password before they can download the file. You can read more about Apache Basic Authentication here: http://www.rahul.net/howto/basicauth.html There are a lot of tutorials online. There are two parts to it. Create the .htpasswd file, and create the .htaccess file. The .htaccess file will go in the upload directory for the form, and will look like this:

Options -Indexes
AuthName "Protected Upload Directory"
AuthType Basic
AuthUserFile /path/on/server/to/file/htdocs/.htpasswd
require valid-user

And then in the file /path/on/server/to/file/htdocs/.htpasswd you will store the authentication information.

This basic auth does not interfere with the uploads, just the access over http (and https).

It's a worthwhile customization but will take a bit of work and the help of your system administrator maybe.

There is a lot to it, but I did it on an installation I have in about 30 minutes or so, including the form. So, for a competent systems administrator, it should not take too long. On shared hosting, it might take longer to accomplish, depending on the support you receive.