Only “www/” should be publicly accessible.