Use reputable apps like Google Photos Locked Folder rather than obscure, free private vault apps.
If you cannot modify the server configuration directly, add a blank index.html file into your sensitive folders. When a browser tries to view the directory, the server will load that blank page rather than generating a list of your files. Implement Robust Authentication indexofprivatedcim