Private files directory Not fully protected

Drupal 10

Step 1

• Go to to  sites/default/files/
• Add new folder name ' private'
• Save

Step 2

• Open setting.php
• Find this, uncomand & typoe as below: # $settings['file_private_path'] = '';

$settings['file_private_path'] = 'sites/default/files/private';