Restricting direct downloads of wp content files, but allow them on the website.

A rule of thumb when thinking about restricting content on the internet: If your client can see the data, they can have it, this is how the internet fundamentally works. Yes you can make it harder for people to get access to the thing you are attempting to restrict them from, but ultimately as soon as your webserver ‘serves’ up data that can be received by the client, the client is of course able to use that data. For example, disabling right-click does not mean that the subtitles have not already been sent to the clients browser. They can still access them using the browsers developer tools. Another example is serving text as an image file. It is still possible to use OCR software to translate the image back into ASCII text. These are simple examples, but it is even possible to decrypt encrypted data with enough computational resources.

I would recommend reading the Apache webserver documentation to see what options are available.

The meaning of life is to find your gift. The purpose of life is to give it away.