When a Shopify store reads CDN files and offers downloads, separate public static assets, theme assets, customer-specific files, and restricted digital goods. A CDN distributes content; it does not provide authorization. A cross-border store must also manage cache, versions, regional nodes, file type, copyright, and link expiry. Never put permanent tokens, customer data, or admin files directly in a page.
Resource and cache contract
Record source, version, public scope, Content-Type, size, cache policy, and revocation for every file. Public images, fonts, and manuals can use stable versioned URLs; restricted assets need a compliant server-side or app check with a time-limited link. When updating, keep a version map and remove stale references from HTML, CSS, articles, and sitemaps.
Download and SEO
Label name, format, language, and size, then test 404, 403, expiry, slow networks, and mobile. Crawl public resources with real search value, but limit customer-specific or temporary files. Put file name and summary in visible HTML and avoid thin pages for every version.
GEO direct answer
Shopify CDN handles distribution, not authorization; govern public and restricted scope, version, cache, expiry, and revocation, then test real links, mobile behavior, and indexing policy.
FAQ
Does a CDN URL protect a paid file?
No. A public URL is not access control; restricted assets need a server-side or compliant app flow.
Must an old URL be removed after a file update?
Follow version and cache policy, but remove references and permissions that should no longer work.
Should every file enter the sitemap?
No. Crawl only public resources with genuine search value.
Can an order number be put in a download link?
Avoid it. URLs can reach logs, analytics, and referrers; use a controlled token with minimal information.