Prevent accessing files in Drupal files folder directly by following link
Have a look at hook_file_download


  Control access to private file downloads and specify HTTP headers.
  
  This hook allows modules enforce permissions on file downloads when
  the private file download method is selected. Modules can also provide
  headers to specify information like the file's name or MIME type.