WordPress is engineered exclusively to reside in web-accessible folders, unlike many less user-centric web frameworks, which separate locations of private (code, etc) and public (assets).
Making filenames hard to guess is about as good as it gets with normal workflow.
To have this really tight you would need completely custom workflow with files places into web-inaccessible directory and moved to public ones at the release time.
Related Posts:
- Turn a URL into an Attachment / Post ID
- Delete Associated Media Upon Page Deletion
- How to prevent posts from being published too close to each other?
- Delete post with all files attached to it
- Is it possible to Schedule Attachments in WordPress?
- what types of order can I pass to get_posts() via orderby?
- Find the post an attachment is attached to
- Immediately published posts are scheduled and published 2 hours later
- media_handle_upload for local files?
- How do I detach images from posts?
- Use an attachment in multiple posts
- delete post also attachments
- Replacing all attachment links in post with media file link
- Get post id by attachment id?
- How can I export WordPress posts’ attachments?
- How to remove images from showing in a post with the_content()?
- How do I create Comma Separated list of attached image ids?
- Get post embedded image caption
- All WordPress scheduled posts are being published immediately
- Limit amount of results returned
- Unschedule a post
- post_parent is 0 when uploading new files
- Easy way to delete 70k posts and attached media?
- Disabled wp-cron, set up system cron but still have missed schedule posts
- How to access featured image?
- Load post attached images on a single page site with fancybox
- Insert woocommerce products programmatically with featured image and gallery
- Add the description field on the attached media
- Set size for attachments
- I have a site where attachments in the wp_posts table have guid values of guid, how did this happen?
- Get all attachment by post excluding featured and content inside
- Prevent Delete Attachment by URL or When Submit
- How to switch wordpress post status between publish and schedule in MySQL?
- Update Modified date when scheduled posts get published
- Posts and Attachments with “Published” status in Search
- Get attachments for posts that belongs to a specific category
- Automatically attach image to post if they have the same title
- Get Image tag from content of post
- Can’t update old posts 3.5.2
- How would one change the default url structure of attachments?
- Get attachments only for this post
- Upload attachment from external site
- Reinstall WordPress while keeping attachments
- Get images from the post
- Scheduling posts via sql
- How To Download WordPress Audio Attachments
- How to get the next and previous image title from attachment or gallery?
- All images on one line for each post
- How do I assign an attachment to a post using only the REST API?
- Unable to delete attached file from folder programmatically
- How to convert attachment pages to Posts?
- Get post attachment with post id
- Delete attached images from posts
- Unable to get all the Posts Attachments
- Create blog post from external source and set publication date
- Add in the url attachment loop the wp_link_pages of the post
- Stop images from being displayed on the front-end of the site
- How to get images only attached from edit post page
- How can I get a comment ID on Submit?
- Bulk Attach Or Insert Media To Post Without Opening Post Editor
- Post Attachment missing head (stylesheets/js/what-not)
- Create post from form with image
- Get Video Attachment to post
- how to edit attachments?
- Broken images after importing posts and opening in Gutenberg
- Can`t attach image to a multiple posts
- Get WordPress post content by post id
- Get page ID of page that is set as the posts page
- Get Posts Under Custom Taxonomy
- How to limit the number of posts that WP_Query gets?
- Stop WordPress Wrapping Images In A “P” Tag
- When is the ‘post_content_filtered’ column in database cleared by WordPress?
- GET the excerpt by ID
- Stop WordPress automatically adding tags to post content
- Determine if page is the Posts Page
- How to get ‘post_content’ without stripping tags?
- How to add an admin notice upon post save/update
- Print Current Post Index number within Loop
- Should we trust the post globals?
- Optimize post insert and delete for bulk operations?
- Get the Current Page Number
- How do you add thumbnail support for custom post types?
- How to mark every 3rd post
- Change Posts per page count
- Keep featured content post in homepage with original order
- How to display related posts from same category?
- Can posts have parents?
- Is there a action hook for the “Empty Trash” button?
- How to end the excerpt with a sentence rather than a word?
- How do I check if I linked to a post before I delete it?
- How to change the case of all post titles to “Title Case”
- Appending content with broken in 4.4
- How to get posts published between a date and today?
- ZIP up all images displayed in a [gallery] and offer as download link
- How to detect single.php (but not single-portfolio.php)?
- How to check if post meta key exists or not in wordpress database
- How to remove a column from the Posts page
- Submit post and upload image from front-end
- removing inline styles from wp-caption div
- What is the use of to_ping and pinged column?