Each server has different permissions needs and you will need to work with your hosting company.

To be able to scan and upload images the php script (user) needs read and write access.

We don’t know if your user is part of the group or you are the owner of that directory only your hosting company or you will know.

To avoid http access please follow the recommendations on the previous post.