/data/media/ is the one place you can NOT use. That’s the standard media folder and is protected from any direct access. Put them anywhere except there.
If the same code and images in the same folder is working locally then you might have accidentally removed the htaccess file that should be protecting that folder.