Private Files Readable
Preventing access to those files should be taken care of by .htaccess files.

You should have .htaccess files under files/civicrm/ConfigAndLog, files/civicrm/upload, files/civicrm/custom with content:

&lt;Files "*"&gt;
  Order allow,deny
  Deny from all
&lt;/Files&gt;


What webserver are you using?  Is this on a hosted environment or your own server?  The server needs to be configured to use .htaccess files

For Apache, see https://httpd.apache.org/docs/current/mod/core.html#allowoverride  

For nginx, see other posts on this site - eg:


Files in the data directory (Upload | Custom)should not be downloadable. (Nginx)
Is CiviCRM compatible with Nginx?
Security Warning on Dashboard (pantheon / nginx)