Secure File Download from a path outside of website root

I have a similar need but am happy for files to be within the site root but the folder must not be browsable. I need to have files in there which are only accessed via logging into the site.

Can this be achieved just by adding a .htaccess into that folder? If so, how should I structure it?

To summarise…

/files/docs
This contains files for logged in users only

Browsing to mydomain.com/files/docs must never show the contents even if they know the filename like mydomain.com/files/docs/doc1.docx

But a logged in person needs to be able to access the files which would be handled by Wappler-built pages.

Hope that makes sense.