Forbid access in var/plugins other than /static folder