Today I published a post on my Discourse site in the staff category as an administrator. There was an image in this post. The URL for this image is publicly accessible. Is this normal? Thank you.

I think so. Otherwise, there would be no need for the #secure-uploads feature: https://meta.discourse.org/t/secure-uploads/meta/140017

Are the images published in the Staff category publicly visible?

Product Support

patrickemin (Patrick EMIN) November 28, 2025, 5:52pm 3

Thanks I didn’t know that functionality

Topic		Replies	Views
How the media in the posts look like when secure uploads are enabled? Product Support secure-uploads	5	437	February 28, 2023
Secure Media Uploads breaks Category Logos Bug	3	1302	August 24, 2020
Secure Uploads Announcements secure-uploads	43	18719	July 24, 2025
S3 Bucket objects restricted access policy as per Discourses groups Product Support	2	961	October 1, 2021
Personal Message attachments accessible to unauthenticated users (missing auth check) Product Support secure-uploads , personal-messages	1	177	July 8, 2025