only allow access to index.php file