Support

This is outside the scope of our support, as it will become evident.I can tell you that you are trying to do is not going to work, ever. Hotlinking protection was a misconception perpetuated by misguided administrators in mid to late 1990s, when the web was in its infancy. Its purpose was to prevent an HTML page hosted on Site B to include media files hosted on Site A, thereby charging Site A's operator with the bandwidth to serve the file. In reality it was a simple filter: "if the Referer header does not match Site A return 403 Access Forbidden". This worked in 1995, it was kinda working in 2005 and it was mostly NOT working in 2015 (since privacy extensions or core features in browsers kill the Referer header anyway).

Besides, what you are trying to do is not hotlinking protection, it's access control. The problem is that you do not want to password protect the documents which is the kind of access control your web server offers you. You want to apply Joomla! ACLs. When you are trying to download a file from the web server using its URL it does not load Joomla. So how could your server know about Joomla! ACLs? Simple. It can't. That's why what you're trying to do won't ever work.

For this reason what you should be looking for is a download manager component such as Phoca Download, DOCman etc. These components don't let you download a file directly with a URL. All downloads have to go through Joomla!, this particular download manager component, therefore through Joomla! ACLs.

This has nothing to do with Admin Tools. It's a different category of software. As a result I will be closing your ticket as out of scope. I hope that I gave you a good hint on what to look for and why :)