# Restrict private folder for direct access
location ~* ^/wp-content/uploads/private/.*.$ {
    deny all;
}