Bug overview:
We have discovered that Plesk is stripping off the X-Acccel and Xsendfile headers added by woocommerce for faster secure downloadable products.
This means the woocommerce_uploads folder cannot be restricted using the recommended Nginx settings - Meaning downloads can be stolen...