Public and Private file system path is the same My company inherited a Drupal 7 site that may not have been properly set up. For example I recently noticed that under Configuration, File System, the "Public file system path" and the "Private file system path" have the same path:

sites/default/files

I'm just wondering what the repercussions might be if I suddenly changed the private files to 

sites/default/files/private

Is it too late for this, since there might be sensitive private files already there that can't just be moved because they're registered in the database? I haven't looked too closely at the files yet. 

Thanks
The private files path should always be outside the webroot directory since users can directly access all those files through just adding /sites/default/files/private/.. to your URL. Private files means that they are delivered through Drupal to add some access permissions.

What you should do now:


Backup your databse and put your site into maintenance.
Go to your files_managed table and find all files stored as private files.
Move those files to a new directory outside your webroot.
Change your private files path to the new path and test if everything is working.