[rose]setting. A good test would be to upload just any image elsewhere, not managed by WordPress, and see what happens. I did notice directory browsing was possible, even if the contents were hidden. That's not good practice. So I might question the hosting quality in general.
