Bypass .htaccess when using download_url

You can inject a made-up referer into WordPress’ HTTP request by filtering pre_http_request. All you need is a simple class like this (untested!):

class FakeWpReferer
{
    private $referer;

    private $url;

    private $is_regex;

    /**
     * @param string $referer
     * @param string $url URL to fake the referer for.
     * @param bool   $is_regex Is $url a regular expression?
     */
    public function __construct( $referer, $url, $is_regex = FALSE )
    {
        $this->referer  = $referer;
        $this->url      = $url;
        $this->is_regex = $is_regex;
    }

    /**
     * @wp-hook pre_http_request
     * @param   array $args
     *
     * @return array
     */
    public function inject( array $args, $url )
    {
        if ( $this->match_url( $url ) )
            $args['headers']['Referer'] = $this->referer;

        return $args;
    }

    /**
     * @param string $request_url
     *
     * @return bool
     */
    private function match_url( $request_url )
    {
        if ( ! $this->is_regex )
            return $request_url === $this->url;

        return (bool) preg_match( $this->url, $request_url );
    }
}

And then register it as a filter:

$fake = new FakeWpReferer(
    'http://example.co.uk/client-area',
    '~^http://www.example.co.uk/uploads/~',
    TRUE
);
add_filter( 'pre_http_request', [ $fake, 'inject' ], 10, 2 );

Then you can use download_url(), and WordPress will use your custom referer. Be aware that everyone else can fake referers too, so your “protection” isn’t really one.