Thank you, flop25.  That's kind of disappointing.  I like the regular old ftp structure because it's so much easier for me to manage, but it also makes it much easier for someone to crawl the site.  :(

I see you explained at http://piwigo.org/forum/viewtopic.php?id=21392 that "It uses an url action.php?id=xx so the script will check if the user can download the picture
To complete that put a Deny from All in a .htaccess in /upload and /galleries, and set correctly the sizes in admin panel"

I've put in a robots.txt , so I'm not too worried about legitimate search engines finding my little family site, but it would still be nice to know that images are not so easily discoverable outside the Piwigo interface.

Do I understand correctly that $conf['original_url_protection'] is set in include/config_default.inc.php but that it (a) protects only the full-size image version as damufo described and (b) is easily defeated through viewing page source or other means?

Is that why you say "Then use watermarks and/or don't set too large image size" -- because no matter what, even if the gallery itself is "protected" by that script, all the variously sized thumbnails under _data will always be accessible -- so you're advising not to make a thumbnail available that would be large enough to substitute for the original image?

Does the Piwigo development team have any plans to change that, and allow both _data/i and galleries to be protected in the same way?

Thanks again, flop25.  That helps clear it up for me.

I'm still not clear on where the extra resource load would occur though.  I checked action.php, and it seems that, after checking user rights, all it really is doing is an @readfile($file); at the end of the script.  I'm not sure why that would use significantly more resources than the web server feeding out the same image file?

Ah I see, thank you.  To do this properly I guess I would have to stop making so many different thumbnails for each image, which I've been doing to allow better display on various sized screens.  Everything's a trade-off.  :)

Hello,
as damufo said, if it's possible to set the path to the folder "_data" outside www or if it's possible to protect all picture's size from non authorized users, it would be very interesting. Some friends of mine hesitate to leave gallery2 for Piwigo for this reason. If I well understand, all solutions will increase server load, but if it's possible to put it like an option, I really think that a lot of people will appreciate to have this choice.

Do it please, with an optional configuration.