Stop Unwanted Printing and Downloads in ONLYOFFICE

To limit printing and downloads in ONLYOFFICE, apply the restriction where access is granted: enable the sharing restriction in Workspace, turn on the link protection in DocSpace, or set document.permissions.print and document.permissions.download to false in a Docs API editor configuration. A Read Only role by itself is not enough in every setup; the exact control depends on whether you use Workspace, DocSpace, or an application integrated with ONLYOFFICE Docs.

These settings limit actions available through the supported sharing or editor interface. They do not prevent every possible copy: a recipient may photograph the screen or use tools outside the application. For sensitive documents, combine the restriction with narrowly assigned access and an appropriate review of who can open the file.

First, identify where the file is shared

ONLYOFFICE has several products and integration patterns, and their controls are not interchangeable. In Workspace, advanced sharing settings apply to users with Read Only and Comment rights. In DocSpace, a restriction can be attached to a particular shared link or configured for a room link and people invited through that link. In a Docs integration, the host application supplies permissions in the editor configuration.

Before changing anything, open the file’s sharing panel and note who needs access, how they reach the file, and whether they are internal users, link recipients, or room members. This inventory helps you choose the relevant control and later test the same access path.

Restrict Workspace users with Read Only or Comment access

1. Open the file’s Sharing Settings. You can access it from the Share button in the editor, the Collaboration tab, or File > Access Rights.
2. In the Sharing Settings window, open Advanced settings using the settings control near the lower-right corner.
3. Select Can’t print, download and copy file (for Read Only & Comment), then save the sharing changes.
4. Check that the affected people have Read Only or Comment access. The restriction applies to those permission groups; do not assume it changes what a Full Access user can do.

The official ONLYOFFICE Workspace sharing guide describes this option for both internal and public sharing. The same guide explains that Read Only and Comment permissions can normally include print and download actions, which is why assigning Read Only alone does not settle this question. If you need to restrict Full Access users from changing sharing settings, that is a separate advanced option; it is not a substitute for the print, download, and copy restriction.

Restrict a DocSpace file shared by link

1. Open the file’s Info > Share panel, or use the file’s context menu to manage links.
2. Create a link or open the settings for the existing link you want to change.
3. Choose the access role the recipient needs, such as Read only, and enable Restrict file content copy, file download and printing.
4. Save the link settings. If the file has several links, review each one: a setting on one link does not automatically prove that other links are restricted.

ONLYOFFICE documents this as a link setting that disables copying file content, downloading, and printing for users who open the file via that link. The DocSpace file-sharing guide also describes who can access a link and how to change its role. If your users access the same file through a room or another direct permission, test those routes separately rather than assuming the file-link setting covers them.

Set DocSpace room-link restrictions separately

For public or custom rooms, room administrators can restrict copying content, downloading files, and printing for people who use a shared room link. The room settings also let administrators set restrictions for people invited through a link independently of the general room-link settings.

1. Open the room’s information or shared-link settings and edit the room link.
2. Enable Restrict file content copy, file download and printing for the room link.
3. If invited users need different treatment, open the invitation-via-link restriction settings and configure that audience separately.
4. Save, then test using a room link and an invited-user account as separate cases.

These controls are documented for room sharing in the ONLYOFFICE DocSpace room-management guide. The available role names and controls can vary with room type and product version, so use the labels shown in your current interface and consult your administrator if a setting is absent.

For an ONLYOFFICE Docs API integration

If your application embeds ONLYOFFICE Docs, the application that opens the editor must pass the permission values in the document configuration. For example:

const config = {
  document: {
    permissions: {
      print: false,
      download: false,
    },
  },
};

Set print and download to false for the relevant editor session, then initialize the editor with that configuration. The ONLYOFFICE Docs API sharing FAQ explains that these values remove the editor’s print and download options. The Docs API does not define your application’s complete authorization or file-storage policy: the integrator controls sharing and delivery. If your backend exposes the source file through a separate URL or endpoint, protect that route too. Hiding an editor command alone does not secure a separately accessible original file.

Verify the restriction from the recipient’s view

1. Use a test account with the same role as the intended recipient, or open the exact link in a clean private browser session.
2. Open the file and check the File menu and toolbar. Print and download commands should be unavailable for the access path you restricted.
3. Try the permitted workflow—such as reading or commenting—to confirm the restriction did not remove needed access.
4. Repeat with every distinct route in use: internal share, public or file link, room link, invited room member, and any alternate integration URL.
5. If a command remains available, confirm that the saved setting belongs to this user, file, link, or room, and verify that the recipient is not using a different permission path.

A successful check confirms that the relevant ONLYOFFICE interface is enforcing the setting for the tested access path. It does not prove that every copy method is impossible. If you cannot find the setting, your product edition, version, role, or integration may differ from the documented interface; check the current product documentation or ask the portal administrator before promising a restriction.