How to block access to the wp-content uploads & wp-Includes folder
By default, everyone is able to access and browse through your wp-content folder by adding ‘wp-content/uploads’ to your domain name. This means they’ll be able to see all ‘Media’ files…