Yesterday I encountered a related issue trying to make an Excel file downloadable. I've done this successfully many times with other web pages and WordPress(WP) themes. The file could not be downloaded by clicking on the link. I had to copy and paste the link into a new browser page. While looking for solutions, I came across this thread. I would like to share the result.
This particular site is hosted on WPengine, using the Genesis child theme Enterprise Pro. I tried another WP site hosted elsewhere and the file downloaded by clicking the link. I started a chat with WPEngine and provided them a link to the problem page and link to the file. They stated the following.
"I am not showing any issues on the server, however when looking at the Browser Inspector I see a Warning: The download attribute on anchor was ignored because its href URL has a different security origin. This could be the cause of the issue, I can add a CORS Header for you, however I would recommend following up with a Developer to see if the Anchor Code needs to be updated. I am not showing any logged errors to pin point the root source of the issue, the only error I am showing is that Browser Inspector Warning that mentions security origins resulting in the attribute being ignored. The CORS Header is essentially just to let the browser know that it is okay to load content even if the Security does not match exactly as long as it is coming from the same source."
I asked them to add the CORS Header. My WPEngine portal has a Production > Web Rules page. In that page is a Header Rules section. They created a rule with the Action: Set, Name: Access-Control-Allow-Origin, Value: *, When: All responses. After adding this rule the link to the file worked as it should. I suppose this could be caused by the theme. In any event, I hope this helps someone with the same issue.