How to prevent viewing files in the server directory?

Question

htaccess

Hello! I generate reports in PDF and PNG and add them to a specific folder. They are loaded via ajax, i.e. you can’t find their address from the old code .. but you can find it through the console, take the address from there and directly access it in the browser.
I tried to close files of a certain type in htaccess but did not get a tangible result

<FilesMatch "\.(pdf|png)$">
 Order Allow,Deny
 Deny from all
 </FilesMatch>

Tell me how to do it? those. so that access is denied via a direct link to a folder (or a file with the .pdf extension), while the execution of scripts for loading these reports is preserved