use private folder, make sure to deny it at server conf