Does not seem to protect direct access

Hi,

as far as I can tell, the "private" directory You chose is actually public because it's a subdirectory of webroot,

try moving private_files outsite webroot (generally this means: outside /var/www if under Linux, or outside C:\Apache24 if under Windows),

alternatively You could place a .htaccess file in private_files denying public access, but I prefer the first method.

Best regards,
MZ