I added an image field for a content type and its directory is /content_type_image. it works correctly but when I add a content to this content type the uploaded image url on the website is www.mysite.com/sites/all/ .... I mean it is clear where this image is in the server directory. Is there anyway to set an alias url for files and images in order to hide such urls?

  • Not a direct answer but might help: you can change the default files directory here: /admin/config/media/file-system. If you change it to files for example, all images will be uploaded there and the sites/default/files/... will not be visible. – Aram Boyajyan Mar 8 '14 at 19:07

You could set your fields to use the private file system. For more information see Working with files in Drupal 7.

With the private file system, the path to files is of the form


The path /system/files is a drupal url, not an actual directory on your file system.

For your drupal file setting you set the path of the private file system to something like /sites/default/files/private so your images are on the server at sites/default/files/private/content_type_image

So the path to the image will be


then when a user hits that url the drupal callback for the system/files will check access control and then load the image from


Using the private file system also means if someone doesn't have access to the content the image is attached to then they cannot browse directly to that file if they can work out the path (and google can't index it) and it means that if you are using revisioning, users cannot see files attached to old revisions of your content, whcih they can with the public file system.

This is probably the best solution you'll get for stopping users from knowing the location of your files and also from accessing files they shouldn't be allowed to.

  • 1
    This is correct, but it should also be noted this comes with a performance penalty as all your images will be served via PHP rather than the webserver itself. It's not worth doing all of this just for URL aesthetics – jmking Mar 9 '14 at 14:33
  • Oh yeah thanks for mentioning that. I had meant to put it in my answer but forgot. Definitely don't do it just for different urls. Only if you want to stop people being able to guess urls and access all your files. (plus this doesn't exactly make nice urls anyway) – rooby Mar 10 '14 at 10:59

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.