This is always something that seems to be overcomplicated, if you generate PDFs or other files and use some form of AJAX to call that file, how do you force the user’s browser to treat the link as an attachment for them to save on their computer? You have to make sure the script hasn’t sent any output and send the headers along with the file data in the following sequence:

// "pdf" can be any other type of valid file
header('Content-type: application/pdf');

// File will be called "document.pdf"
header('Content-Disposition: attachment; filename="document.pdf"');

// The actual PDF file on the server can be called anything.  This is a clever way to obfuscate the real file name from the public, by using a different naming convention.

readfile('/path/to/source/file.pdf');