Images/Files stored in upload folder are openly accessible

[avonville]

https://wordpress.org/support/topic/store-attachement-elsewhere/

Should we look into a more secure option? For instance how gravity forms stores uploads.

From Gravity Forms.

The Gravity Forms Uploads Folder
Gravity Forms creates a subfolder structure in the WordPress uploads root which is used to save uploaded files. Files are stored in folders with unique names created with the same algorithm WordPress uses (salted HMAC-MD5) and are impossible to crack with brute force. A folder containing the files for the form will have a path similar to this:
/path/to/wordpress/wp-content/uploads/gravity_forms/82-ea1cf844318d032fd7e8fa8w1dacdfbe
You will notice empty index.html files in all of the subfolders. The purpose of these files is to prevent directory listings appearing in search engines for Web servers that are poorly configured. Please don’t remove these files, they are there to protect you.