I have a file attached to a node via a link. The node is published but the file is unpublished. The link on the node points to the file /sites/default/files/file.txt
The file is still downloadable by anonymous users.
I would assume the file, being unpublished, would be unavailable to download. This is not the case.
The anonymous permissions are set to view published content.
Is this expected behaviour? What would be the best way to not allow the file to be downloaded once it's unpublished?