How to configure Drupal 7 to have private files folder. And also this configuration is secure within Nginx config.
To set up a private files folder, navigate to: Administration » Configuration » Media » File system. Create a path from the Unix root for the "Private file system path" (e.g.
/var/files) outside of the Drupal root.
Make sure that this folder is readable and writable by the web server user.
By having this folder outside of the Drupal root, it is secure. It cannot be compromised through the web server.