+ empty attachments dir and restrict access to it via .htaccess ;