Preventing access to those files should be taken care of by
You should have
.htaccess files under
files/civicrm/custom with content:
<Files "*"> Order allow,deny Deny from all </Files>
What webserver are you using? Is this on a hosted environment or your own server? The server needs to be configured to use
For nginx, see other posts on this site - eg:
You need to check the permissions on the hosting server for the directories in the warning. The directory permissions should be set to 0755, or it may show as 755. The files within the directories should show 0644, or 644.