Create a folder into wp/assets and protect the direct download of the files that contains. You can configure the control of the access.