diff --git modules/system/system.install modules/system/system.install
index 4caeaa9..e0d6b9d 100644
--- modules/system/system.install
+++ modules/system/system.install
@@ -267,20 +267,21 @@ function system_requirements($phase) {
 
   // Test files directories.
   $directories = array(
-    variable_get('file_public_path', conf_path() . '/files'),
-    // By default no private files directory is configured. For private files
-    // to be secure the admin needs to provide a path outside the webroot.
-    variable_get('file_private_path', FALSE),
+    'public' => variable_get('file_public_path', conf_path() . '/files'),
   );
+  // By default no private files directory is configured.
+  if (variable_get('file_private_path', FALSE)) {
+    $directories['private'] = variable_get('file_private_path', FALSE);
+  }
 
   // Do not check for the temporary files directory at install time
   // unless it has been set in settings.php. In this case the user has
   // no alternative but to fix the directory if it is not writable.
   if ($phase == 'install') {
-    $directories[] = variable_get('file_temporary_path', FALSE);
+    $directories['temp'] = variable_get('file_temporary_path', FALSE);
   }
   else {
-    $directories[] = variable_get('file_temporary_path', file_directory_temp());
+    $directories['temp'] = variable_get('file_temporary_path', file_directory_temp());
   }
 
   $requirements['file system'] = array(
@@ -288,8 +289,9 @@ function system_requirements($phase) {
   );
 
   $error = '';
+  $private_directory_writable = FALSE;
   // For installer, create the directories if possible.
-  foreach ($directories as $directory) {
+  foreach ($directories as $directory_type => $directory) {
     if (!$directory) {
       continue;
     }
@@ -329,6 +331,53 @@ function system_requirements($phase) {
       else {
         $requirements['file system']['value'] = $t('Writable (<em>private</em> download method)');
       }
+      if ($directory_type == 'private') {
+        $private_directory_writable = TRUE;
+      }
+    }
+  }
+
+  // Ensure that a private directory is protected (if we know it's writable).
+  if ($phase == 'runtime' && $private_directory_writable) {
+    $private_directory = variable_get('file_private_path', FALSE);
+    if ($private_directory) {
+      $test_file = file_unmanaged_save_data("This is a file to test private download security, and can be safely removed.\n", "private://DRUPAL_PRIVATE_FILES_TEST.txt");
+      if (!empty($test_file)) {
+        $requirements['file_system_private_secure'] = array(
+          'title' => $t('File system private directory'),
+        );
+
+        $http_result = drupal_http_request(url($base_url . '/' . $private_directory . substr($test_file, 9)));
+        if (!isset($http_result->error)) {
+          $requirements['file_system_private_secure']['description'] = $t('The private files in %directory are publicly accessible. To ensure that the directory is not directly accessible either move it outside of your website root (and change the path at the <a href="@admin-file-system">file system settings page</a>) or configure your web server to block access to the directory.', array('%directory' => $private_directory, '@admin-file-system' => url('admin/config/media/file-system')));
+          $requirements['file_system_private_secure']['severity'] = REQUIREMENT_ERROR;
+          $requirements['file_system_private_secure']['value'] = $t('Not secure');
+        }
+        else {
+          $requirements['file_system_private_secure']['value'] = $t('%directory is not directly accessible from the web.', array('%directory' => $private_directory));
+        }
+        file_unmanaged_delete($test_file);
+      }
+    }
+  }
+
+  // Ensure that a private directory is protected.
+  if ($phase == 'runtime') {
+    $private_directory = variable_get('file_private_path', FALSE);
+    if ($private_directory) {
+      $requirements['file_system_private_secure'] = array(
+        'title' => $t('Private files directory security'),
+        'value' => $t('%directory is not directly accessible from the web.', array('%directory' => $private_directory)),
+      );
+
+      $test_file = file_unmanaged_save_data("This is a file to test private download security, and can be safely removed.\n", "private://DRUPAL_PRIVATE_FILES_TEST.txt");
+      $http_result = drupal_http_request(url($base_url . '/' . $private_directory . substr($test_file, 9)));
+      if (!isset($http_result->error)) {
+        $requirements['file_system_private_secure']['description'] = $t('The directory %directory is publicly accessible, allowing access to private files without checking access permissions. Ensure that the directory is not directly accessible by moving it outside of your website root or configuring your web server to block access to the directory.', array('%directory' => $private_directory));
+        $requirements['file_system_private_secure']['severity'] = REQUIREMENT_ERROR;
+        $requirements['file_system_private_secure']['value'] = '';
+      }
+      file_unmanaged_delete($test_file);
     }
   }