WordPress uploads are public by default, so your files can be hotlinked or pulled into search results. This article shows server-level hotlink blocking, noindex headers, and ways to protect attachment pages.