By default, Drupal serves all its files publicly via http. This means that any unauthorized user can directly access all the files through a browser by entering its path. This is also true for files which have permissions for them. The solution provided by Drupal, which is to make the entire file system private is resource intensive and can bring down the server. However there is another less costly workaround to this issue. Read on to find out more.