In this guide we will create a Private files folder for Drupal.

Prerequisites

• A Drupal setup

Private folder creation

Create a folder with www-data ownership:

$ sudo mkdir /srv/webadmin/cms/sites/default/private
$ sudo chown www-data:webadmin /srv/webadmin/cms/sites/default/private

Set the new private folder in Drupal settings:

Administration -> Configuration -> Media

Then use these setting:

• Private file system path: sites/default/private
• Default download method: Private local files served by Drupal

Setup Nginx

We need to add this rule under the cms virtualhost configuration (/etc/nginx/sites-enabled/cms) under the server section:

        location ~ ^/sites/.*/files/(private|temp|tmp|backup_migrate) {
                 deny all;
        }

Reload Nginx:

$ sudo systemctl reload nginx

References

• https://www.drupal.org/node/2709571