securing files on the web

I have a web site that requires a log in and that works fine for all the individual web pages. But how do I protect a few .zip files from being downloaded by manually entering the correct url to the file? Even if the files are in a protected directory the files can still be downloaded by entering the url. Would I have to use a .htaccess file on the apache server? That would cause the person logged in to the site to log in again to download the file, right? And also require a second username and password list? My site currently uses a .php script and mysql database to handle logins.