Below

if ($_SERVER['HTTP_REFERER'] != "http://www.funfile-world.com/") {

        header("HTTP/1.1 404 Not Found");

    }

Add:

if (strstr($_GET['file'], "../")) {
    die("Hacking Attempt");
}

    if ($_SERVER['HTTP_REFERER'] != "http://www.funfile-world.com/") {

        header("HTTP/1.1 404 Not Found");

    }

        $dir="/path/to/your/file/directory/";
        $filename = $dir.$_GET['file'];

    if (isset($_REQUEST['file']) && file_exists($filename) ) {

        header("HTTP/1.1 200 OK");
        header("Status: 200 OK");
        header('Pragma: private');
        header('Cache-control: private, must-revalidate');
        header('Content-type: application/force-download');
        header( "Content-Disposition: attachment; filename=".basename($filename));
        header('Content-Length: ' . filesize($filename));
        header( "Content-Description: File Transfer");
        readfile($filename);
    } else {
        echo 'No file with this name for download.';
    }

you can add more function to have more control of your downloader...