Uploaded Files on Your Website Are Public

The estate agent rang a building surveyor's office in Tipperary with a question nobody there could answer. A house on her books had just gone sale agreed. Curious how the listing looked, the vendor had typed the address into Google, and the third result was a twelve-page pre-purchase survey of that same house: the damp readings, the roof, the buyer's name on the cover page. It was sitting on the surveyor's own website.

That surveyor is a composite, built from a pattern any hosting operations team will recognise. The mechanics are real. A report too big for email was uploaded to the website's media library so the buyer could be sent a link. It was never added to any page. Everyone involved assumed that an address nobody had been told about was an address nobody could find.

It does not work like that. If you have ever used your website to send someone a file, an hour this week will tell you what yours is holding.

How a File Nobody Linked Ends Up in Google

Every file you upload to WordPress gets its own public web address the moment the upload finishes. No login sits in front of it, and no page has to link to it. Anyone holding the address can open it, and so can any crawler that comes across it.

The address is also more predictable than people expect. WordPress's own documentation describes the default setting that sorts uploads into folders by year and month, so a file uploaded in June 2018 lands in a folder ending /2018/06 ^[1]. Give the file a sensible name, such as survey-report-final.pdf, and the address is half guessable before anyone forwards it.

Unlinked is not the same as hidden

And it does get forwarded. In the surveyor's case the buyer sent the link to a solicitor, the solicitor's office sent it on to a mortgage broker, and somewhere along that chain the address was pasted into a place a crawler could read. Nobody ever establishes which step it was. It hardly matters. One public copy of the address is enough.

Once found, a file is treated like any other document. Google's list of indexable file types includes PDF, Word and Excel files ^[2], which covers almost everything a small firm sends to a client. The text inside is searchable too. In practice, that means a customer's name, a home address or the words rising damp can return your private paperwork to a stranger who typed them for a completely different reason.

A private page does not lock the file on it

Careful owners get caught here. Plenty of businesses do the right thing and put client material behind a password-protected page on their website. The page is protected. Whatever PDF it links to is not. Uploaded files are served directly from the uploads folder, so the password guards the doorway while the document sits in a room with a separate, unlocked door. Anyone who has the file's address, from a forwarded email or a shared browser, skips the password entirely.

Some membership and file-protection plugins add a lock to the files themselves. Whether that lock holds depends on the plugin and on the server it runs on, so verify it: open a protected file's address in a private browser window while logged out. If it opens, it is public.

The page has a lock. The file behind it has its own door.

What Is Probably Sitting in Your Media Library

Most owners have never scrolled to the bottom of their media library. Years of convenient shortcuts collect there. The usual suspects, by type of business:

Trades and home services: signed quotes and invoices with a customer's home address on them, uploaded so the link could go out by text.
Professional services: reports, engagement letters and draft documents, uploaded because the email attachment bounced.
Hospitality and events: completed booking forms, a dietary requirements list for a wedding party, a supplier's price sheet.
Any employer: a staff rota with mobile numbers, or CVs that arrived through a careers form.

That last one is easy to miss. Some contact and application form plugins store the files people attach in a subfolder of uploads, and whether those files can be reached publicly depends on the plugin and its settings. Verify yours rather than assuming.

Trade price lists deserve a mention as well. They are not personal data, so no regulator gets involved, but a competitor reading your margins in a search result is its own kind of bad afternoon.

Finding and Removing Exposed Files in Five Steps

This is the bit worth doing this week. For most sites it takes about an hour, longer if the media library goes back a decade.

Search. Type site:yourdomain.ie filetype:pdf into Google, then repeat with docx and xlsx. Google itself notes that the site: operator does not necessarily return every indexed address ^[3], so treat a clean result as reassurance, not proof.
Audit. Open the Media Library, switch to list view and filter by Documents, then Spreadsheets. Sort by date and work through anything that names a person, an address or a price.
Delete. Choose Delete permanently on anything that should never have been public. Then verify: paste the old file address into a private browser window and confirm it returns a not-found page rather than the document.
De-index. In Google Search Console, the Removals tool hides an address from results while Google catches up. Google states that a request lasts only about six months, and that permanent removal needs the file gone so the server returns a 404 or 410 not-found response ^[4]. Step 3 plus step 4 finishes the job. If somebody else's site is holding a copy, Google's separate Refresh Outdated Content tool is the route.
Record. Write down what was exposed, roughly how long it was public, and what you did about it. The next section explains why that note matters.

When an Exposed File Counts as a Data Breach

A public file containing someone's personal details is more than an embarrassment. Under GDPR, a breach of security that leads to unauthorised disclosure of personal data is a personal data breach. It does not need a hacker to qualify. A link that ended up in the wrong place counts.

The Data Protection Commission sets out the duties plainly. Report a breach to the DPC within 72 hours of becoming aware of it where it presents a risk to the people affected. Tell those people directly where the risk is likely to be high. Keep an internal record even when you conclude there is no risk ^[5]. That record is the note from step 5.

This is everyday territory for the regulator. The DPC's 2025 annual report recorded roughly six and a half thousand valid breach notifications, about a sixth fewer than the year before, and said almost half came from correspondence sent to the wrong recipient ^[6]. A public file address is the same failure with a wider audience. The letter went to whoever looked.

Where the judgement call sits

I run operations, not a legal practice. Whether a particular exposure clears the reporting threshold depends on what was in the file and who could plausibly have seen it, so take proper advice on that call. From the operational side, one point matters most: the 72 hours run from when you become aware. In the surveyor's case, the clock started when the estate agent rang, not when somebody got round to looking into it.

The Copies Deletion Cannot Reach

Deleting the file closes the main door. Some copies survive, and it is better to know where they are before you sign off the clean-up.

Backups. A nightly backup taken while the file was on the server still contains it. That is the backup doing its job. It also means that restoring a backup from before your clean-up quietly redeploys the document to production. If you roll back for an unrelated reason, repeat step 3 and verify the old address again.
Downloads. Anyone who opened the file may have saved it. No setting on any website recalls a copy from someone's laptop.
Search results and previews. These clear once Google recrawls the missing address, which is exactly why step 4 depends on step 3.

None of this is a reason to run without backups. Without a restore point, an over-eager clean-up that deletes the brochure your homepage depends on means rebuilding it from whatever is left on someone's laptop. Our WordPress security and backup guide covers why that restore point matters. Just know that deleted means deleted from production, and plan the clean-up with the backups in mind.

A clean-up removes the file from production. Older backups still hold it until they age out.

Where Confidential Files Should Live Instead

The surveyor's real error was using a public shopfront as a filing cabinet. The fix starts with a clear rule for what each place is for.

A proper home for confidential documents does four things. Each recipient has to identify themselves, instead of whoever holds a link getting straight in. Access expires. You can see who opened what. And the material stays well away from the pages you want Google to read. For most small firms, a file-sharing service with expiring, recipient-only links covers all four, and so does a plain email attachment when the file is small enough.

When a website is the wrong tool entirely

To be fair about it, if your business exchanges confidential documents with clients every day, as many accountancy and legal practices do, a dedicated client portal built for exactly that job will suit you better than any website platform, ours included. That is simply not a website's job.

Your website's job is the public side: the pages, photos and downloads you want people to find. For that, the hosting underneath decides how painful a clean-up is. On Web60, your site runs on Irish-hosted infrastructure with nightly backups and one-click restore, and all data stays in Ireland. In practice, that means a clean-up that goes too far costs you minutes rather than an afternoon of re-uploading. The built-in file manager also lets you look directly inside the uploads folder, which helps when the media library has lost track of a file that is still on disk. And if your current site is more filing cabinet than shopfront, the AI builder will have a fresh WordPress site designed in under a minute, for €60 a year with all of that included.

What the Surveyor Changed

In the composite, the fix was undramatic. The report came down that afternoon, the removal request went in, the buyer and vendor were told, and the practice took advice on notifying the DPC. The lasting change was a habit. Reports now go out through a file-sharing service with expiring links, and the website went back to being a shopfront.

Your own media library may be holding nothing worse than old brochures. An hour with the five steps above will tell you for certain, and you will know exactly what Google can see before anybody else has to tell you.

Frequently Asked Questions

Are files in the WordPress media library public?

Yes, by default. Every uploaded file gets its own web address and is served directly, with no login in front of it. Making the page that links to the file private or password protected does not change that. Some plugins add protection to the files themselves, so verify by opening the file's address in a private browser window while logged out.

How do I stop a PDF from showing up in Google?

Delete the file from your site so its address returns a not-found response, then use the Removals tool in Google Search Console to hide it from results while Google catches up. Google says a removal request lasts about six months, so the deletion is what makes it permanent. If the file must stay online but out of search, it needs to sit behind a real login rather than an unlinked address.

Can Google find a file if I never linked to it?

It can. Unlinked is not the same as hidden. If the address is forwarded, pasted into a chat or published anywhere a crawler can read, Google can discover it, and it indexes PDF, Word and Excel files as readily as web pages.

Is a document exposed on my website a GDPR breach?

It can be. If the file contains personal data and could be seen by people who should not have it, that is a personal data breach even though nobody hacked anything. The Data Protection Commission expects a report within 72 hours where there is a risk to the people affected, and an internal record either way. Take advice on whether your case meets the threshold.

Does deleting a file from my website delete it from backups?

No. Backups taken while the file was on the server still contain it until they age out, and restoring one of those backups will put the file back on your site. If you restore for any reason after a clean-up, verify the old file addresses again.