[ericgtr]

Interesting, I guess I never paid attention to this but you are right. A couple of things to consider are that the actual URL is never given so someone would have to know the name of your attachment directory. The other thing is that the files are non-descript eg. file.attach so there is no telling what that file actually is.

Still, protecting it is a good idea. You can drop a simple blank index.htm in the root of your attachment fold and it won't be accessible. To do this create a blank .txt file and rename it to index.htm and upload it into the root of your attachment folder.