Unpublished file still downloadable I have a file attached to a node via a link. The node is published but the file is unpublished. The link on the node points to the file /sites/default/files/file.txt

The file is still downloadable by anonymous users. 

I would assume the file, being unpublished, would be unavailable to download. This is not the case. 

The anonymous permissions are set to view published content. 

Is this expected behaviour? What would be the best way to not allow the file to be downloaded once it's unpublished?
You need to setup a private file system in settings.php:

/**
 * Private file path:
 *
 * A local file system path where private files will be stored. This directory
 * must be absolute, outside of the Drupal installation directory and not
 * accessible over the web.
 *
 * Note: Caches need to be cleared when this value is changed to make the
 * private:// stream wrapper available to the system.
 *
 * See https://www.drupal.org/documentation/modules/file for more information
 * about securing private files.
 */
# $settings['file_private_path'] = '';


Files stored in the private file system will be served by Drupal and you can control which users are allowed to access the files.