Changed
Context
Uploaded images can be viewed by anyone, despite using Shield to protect the site.
How to use private files for images, and move existing images?
Analysis
I incorrectly had File FIeld Paths as private://2026-09
Resolution
Reset path to 2026-09.
Set Upload destination field property to private.
Use retroactive setting to fix file paths.
Removed anonymous permission to view all media revisions for Photo, which seemed to be related.
Modules
Questions