How to block external download link access if visitor not referred from WP?

Question

Although not a question for this place (perhaps try over at StackOverflow https://stackoverflow.com/ ), you could try

checking the referring page (although that can be spoofed)
setting a cookie on WP and looking for it on the other site (although the 2nd site may not be able to read the first site’s cookie). (added) Domain 2 cannot read a cookie that domain 1 sets – see https://stackoverflow.com/questions/2919968/php-read-a-cookie-that-is-on-another-domain – so this choice will not work across domains.
setting a query variable as you redirect from site 1 to site 2 and checking that queary variable on site 2
only showing the links on the WP page if the user is logged in (otherwise, there is no link shown to the non-logged in user). (Which means, if your question said “How do I show a link only to a logged-in WP user?”, that might have been more proper for this place.)

Added

Based on the two links I provided in my comments to my answer, and to show you how easy it is to do the 4th choice (the best cboice) using information in those two links, here is some sample code to allow a shortcode to show the HREF link only to logged in users.

// function for the [url] shortcode
function show_link_to_users ($atts) {
    // check if user is logged in
    if (is_user_logged_in()) { 
        $the_link =  "a href="". $atts["link'] . "'>$atts['url'</a>";
    }
    return;     // returns a null if user not logged in
    }

add_shortcode('url', 'show_link_to_users');

/*  Usage in content area of page/post

 This link only shown for logged in users: [url="https://www.example.com/somepage/here"]

The HREF link will only be shown for logged in users.

Note: no sanitation of the link value in the shortcode
*/

This code would be placed in your Child Theme’s functions.php file. (You don’t want to put it in your theme’s functions.php file, because a theme update will overwrite (destroy) the code. (Read up on Child Themes – there are tons of them out there on the googles/bings/ducks.)

Also Added

If you want to block access to a URL on your site that someone would type in (or a URL that was shared unuathorized), then you will need to use htaccess/htpasswd rules to block a specific file or subfolder of the site.

You can’t do it with WP functions (pretty sure), because the user could access the link directly, rather than through a link on your page.

And Added More

Background thinking about this. General idea, but will take some programming.

Put all downloadable/hidden content in the same subfolder of the site.
Use htaccess rules to redirect all requests to any file in that subfolder to a specific page
that specific page has a template that checks if the user is logged in.
if user is logged in, then provided the file to download via headers (not a link)
if user is not logged in, display a message telling them to log in.

You could use a query value to specify the file to download (via a lookup in a custom table that links the query value to the file to provide via the headers.

Related Posts: