进行了一些优化

src/Admin/SchemaProvider.php

@@ -291,9 +291,34 @@ class SchemaProvider {
             }
         }
 
+        if ($domain === 'permissions' && $section === 'download') {
+            $alias = trim((string) ($data['url_alias'] ?? ''));
+            if ($alias === '') {
+                $errors[] = __('下载链接 URL 别名不能为空', 'aksrt');
+            } elseif (strlen($alias) > 48) {
+                $errors[] = __('下载链接 URL 别名长度不能超过 48 个字符', 'aksrt');
+            } elseif (!preg_match('/^[A-Za-z0-9_-]+$/', $alias)) {
+                $errors[] = __('下载链接 URL 别名只能包含英文字母、数字、连字符和下划线，禁止中文、空格和 / \\ ? # & 等特殊符号', 'aksrt');
+            } elseif (in_array(strtolower($alias), $this->reserved_download_aliases(), true)) {
+                $errors[] = __('该别名与系统保留路径冲突，请更换其他别名以避免路由 404', 'aksrt');
+            }
+        }
+
         return ['valid' => empty($errors), 'errors' => $errors];
     }
 
+    /**
+     * Top-level slugs that must never be shadowed by the download route.
+     */
+    private function reserved_download_aliases(): array {
+        return [
+            'wp-json', 'wp-admin', 'wp-content', 'wp-includes',
+            'admin', 'login', 'logout', 'register', 'lostpassword',
+            'feed', 'search', 'author', 'page', 'comments',
+            'sitemap', 'sign', 'cgi-bin',
+        ];
+    }
+
     public function read_settings(string $domain, string $section = ''): array {
         if ($section !== '') {
             $schema = $this->get_section_schema($domain, $section);