diff --git src/wp-admin/includes/file.php src/wp-admin/includes/file.php
index bc98129855..361f0896c4 100644
--- src/wp-admin/includes/file.php
+++ src/wp-admin/includes/file.php
@@ -978,6 +978,7 @@ function wp_handle_sideload( &$file, $overrides = false, $time = null ) {
  *
  * @since 2.5.0
  * @since 5.2.0 Signature Verification with SoftFail was added.
+ * @since 5.3.0 Introduced `download_url_remote_get_args` filter.
  *
  * @param string $url                    The URL of the file to download.
  * @param int    $timeout                The timeout for the request to download the file. Default 300 seconds.
@@ -997,15 +998,36 @@ function download_url( $url, $timeout = 300, $signature_verification = false ) {
 		return new WP_Error( 'http_no_file', __( 'Could not create Temporary file.' ) );
 	}
 
-	$response = wp_safe_remote_get(
-		$url,
-		array(
-			'timeout'  => $timeout,
-			'stream'   => true,
-			'filename' => $tmpfname,
-		)
+	/**
+	 * Filters the HTTP request arguments in `download_url`.
+	 * 
+	 * @since 5.3.0
+	 * 
+	 * @see wp_safe_remote_get()
+	 * 
+	 * @param array  $upload                 Array of HTTP request arguments. `timeout`, `stream`, and `filename` cant be overridden.
+	 * @param string $url                    The URL of the file to download.
+	 * @param bool   $signature_verification Whether to perform Signature Verification. Default false.
+	 * */
+	$remote_get_args = apply_filters( 'download_url_remote_get_args', array(), $url, $signature_verification );
+
+	$default_remote_get_args = array(
+		'timeout'  => $timeout,
+		'stream'   => true,
+		'filename' => $tmpfname,
 	);
 
+	// Prevent the {@see 'download_url_remote_get_args'} to override default arguments.
+	foreach( $default_remote_get_args as $default_arg_key => $default_arg_value ) {
+		if ( isset( $remote_get_args[$default_arg_key] ) ) {
+			unset( $remote_get_args[$default_arg_key] );
+		}
+	}
+
+	$remote_get_args = array_merge( $default_remote_get_args, $remote_get_args );
+
+	$response = wp_safe_remote_get( $url, $remote_get_args );
+
 	if ( is_wp_error( $response ) ) {
 		unlink( $tmpfname );
 		return $response;