How to make existing public files private?
Thanks a lot for the answers! FileField Paths definitely is the way to go.


Update the file field's field storage to handle private files.
Run FileField Paths' Retroactive update on your content type's file field.




Step 1. can be accomplished from within hook_update_N (if you use configuration management do that locally and then export the updated configuration and deploy the resulting *.yml):

$field_type = 'file';
$field_name = 'field_file';

if (!$field_storage_configs = \Drupal::entityManager()
  -&gt;getStorage('field_storage_config')
  -&gt;loadByProperties(['type' =&gt; $field_type])) {
  return;
}

foreach ($field_storage_configs as $field_storage) {
  // Note: These settings apply to the field_file field everywhere it is
  // used.
  if ($field_storage-&gt;getName() == $field_name) {
    $field_storage-&gt;setSetting('uri_scheme', 'private');
    $field_storage-&gt;enforceIsNew(FALSE);
    $field_storage-&gt;save();
  }
}


Alternatively, follow the manual config update and reimport as suggested in the question.



Step 2. is to go to your file field's edit screen and fire the Retroactive update upon saving the form: