this has been posted previously.
to sum up the previous posts:
1) move the zip file outside of the apache web root
2) have your php script authenticate the user
3) before anything is sent to the clients browser, set the headers to the zip mime type
4) send the file using a php function like readfile().