Add the following line in the .htaccess file of your WordPress to prevent the access of downloadable resources without authentication.
Add this lines below the “RewriteBase /”
RewriteCond %{REQUEST_FILENAME} ^.*(png|pdf|jpeg|gif|bmp|pdf|doc)$
RewriteCond %{HTTP_COOKIE} !^.*wordpress_logged_in.*$ [NC]
RewriteRule . – [R=403,L]
You can prevent the access of any downloadable resources by adding its file type in line 1 above. eg. mp3, jpeg etc.