These are the headers we use for our downloads:
// get file size of dowload file
$file_size = strlen($file_data);
header("Pragma: public");
header("Expires: 0");
header('Last-Modified: '.gmdate('D, d M Y H:i:s') . ' GMT');
// different variations of Cache-Control header
//header("Cache-Control: must-revalidate, post-check=0, pre-check=0");
header("Cache-Control: no-store, no-cache, must-revalidate"); // HTTP/1.1
header("Cache-Control: pre-check=0, post-check=0, max-age=0"); // HTTP/1.1
header("Cache-Control: private", false);
// different variations of Content-Type header
//header("Content-Type: application/octet-stream");
header("Content-Type: application/force-download");
header("Content-Type: application/octetstream; name=\"".$display_name."\""); //This should work for IE & Opera
header("Content-Type: application/octet-stream; name=\"".$display_name."\""); //This should work for the rest
// different variations of Content-Disposition header
header("Content-Disposition: attachment; filename=\"".$display_name."\";");
//header("Content-Disposition: inline; filename=\"".$display_name."\"");
// different variations of Content-Transfer-Encoding header
header("Content-Transfer-Encoding: none");
//header("Content-Transfer-Encoding: binary");
header("Content-Length: ".$file_size);