here is my demo site that this use case is working via sites

http://sitesdemo.force.com/realty/listing?id=a0h30000002KaqhAAC

I have a custom object where I define real estate listing details. And the above page creates the links for the attachments on listing records.

here is the page code:

<apex:page title="Big Cloud Realty" showHeader="false" controller="ListingController">
    <apex:composition template="bigCloudTemplate">
        <apex:define name="mainContent">
        
            <apex:outputPanel layout="block" styleclass="block" style="float:left;display:inline;width:445px">
                <div class="blockTitle"><span class="blue">Listing</span> Details</div>
                <div class="blockBody">
                    <h2>
                        {!listing.Address__c}<br/>
                        {!listing.Neighborhood__c}
                    </h2>
                    <p/>
                    <b>{!listing.Tag_Line__c}</b><br/>
                    {!listing.Description__c}
                    <p/>
                    Age: {!ROUND(listing.Age__c,0)}<br/>
                    Bedrooms: {!ROUND(listing.Bedrooms__c,0)}<br/>
                    Bathrooms: {!ROUND(listing.Bathrooms__c,0)}<br/>
                    Status: {!listing.Status__c}
                    <p/>
                    <apex:outputLink value="{!$Page.inquire}?lid={!listing.Id}">Inquire about this listing</apex:outputLink>
                    <p/>
                    <apex:outputPanel layout="none" rendered="{!NOT(ISPICKVAL($User.UserType,'Guest'))}">
                        <apex:form >
                            <apex:commandLink action="{!watch}">Watch this Listing</apex:commandLink>
                        </apex:form>
                        <p/>
                    </apex:outputPanel>
                    Pictures:<br/>
                    <apex:repeat value="{!pictures}" var="pic">
<br/>
                         <apex:outputLink value="{!URLFOR($Action.Attachment.Download, pic.id)}">{!pic.name}</apex:outputLink>
                    </apex:repeat>
                    <p/>
                </div>
            </apex:outputPanel>
                    
        </apex:define>
    </apex:composition>
</apex:page>

and here is the controller code:

public class ListingController {
    
    private String listingId {
        get {
            return ApexPages.currentPage().getParameters().get('id');
        }
    }
    
    public Listing__c listing {
        get {
            return [SELECT Id, Name, Address__c, Age__c, Agent__r.Name, Asking_Price__c, Bathrooms__c,
                Bedrooms__c, Description__c, Neighborhood__c, Status__c, Tag_Line__c, Master_Picture_ID__c
                FROM Listing__c WHERE Id=:listingId LIMIT 1]; 
        }
    }
    
    public Attachment[] pictures {
        get {
            return [SELECT Id, name FROM Attachment WHERE ParentId=:listingId ORDER BY CreatedDate ASC];
        }
    }
    
    public PageReference watch() {
        WatchItem__c watchItem = new WatchItem__c(Listing__c = listingId);
        Insert watchItem;
        return null;
    }
    
    testmethod static void test() {
        User agent = TestSupport.getAgent();
        Listing__c l = TestSupport.createListing(true, agent.Id);
        
        Test.setCurrentPage(new PageReference('/listing?id=' + l.Id));
        ListingController lc = new ListingController();
        
        Listing__c controllerListing = lc.listing; 
        System.assertEquals(lc.pictures.size(), 0, 'Should not have any pictures attached to this listing.');

        lc.watch();     
    }
}