Moodle stores the files uploaded by the users in a data directory. This directory should not be accessible to the general public over the web, that is, you should not be able to type in the URL for this directory and access it using a web browser. You can protect it either using a .htaccess file or by placing the directory outside of the web server's documents directory.
The Moodle data directory
Get Moodle 3 E-Learning Course Development - Fourth Edition now with the O’Reilly learning platform.
O’Reilly members experience books, live events, courses curated by job role, and more from O’Reilly and nearly 200 top publishers.
