Have a look at [Perusio's config](https://github.com/perusio/drupal-with-nginx#private-file-handling), it has all the information and explanation you need : > This config assumes that private files are stored under a directory > named private. I suggest `sites/default/files/private` or > `sites/<sitename>/files/private` but can be anywhere inside the site > root as long as you keep the top level directory name private. (...) > Example: Calling the top level private files directory protected > instead of private. > > > > > location ^~ /sites/default/files/protected { > internal; > } > > Now any attempt to access the files under this directory directly will > return a 404. ... > The usual practice involves setting up a directory outside of > files directory and giving write permissions to the web server user. > (...) I think it to be less advisable, in the sense that now **there's another directory that is writable by the server.** > > I prefer to use a directory under files, which is the only one that is > writable by the web server, and use the above location (protected or > private) to block access by the client to it. In short, marking it as internal is enough.