Add index files
Add .htaccess files (deny from all)
Security check on ajax request