diff --git a/admin/.htaccess b/admin/.htaccess
new file mode 100644
index 000000000..8d2f25636
--- /dev/null
+++ b/admin/.htaccess
@@ -0,0 +1 @@
+deny from all
diff --git a/include/.htaccess b/include/.htaccess
new file mode 100644
index 000000000..8d2f25636
--- /dev/null
+++ b/include/.htaccess
@@ -0,0 +1 @@
+deny from all
diff --git a/install/.htaccess b/install/.htaccess
new file mode 100644
index 000000000..8d2f25636
--- /dev/null
+++ b/install/.htaccess
@@ -0,0 +1 @@
+deny from all
diff --git a/language/.htaccess b/language/.htaccess
new file mode 100644
index 000000000..8d2f25636
--- /dev/null
+++ b/language/.htaccess
@@ -0,0 +1 @@
+deny from all
diff --git a/template-common/.htaccess b/template-common/.htaccess
new file mode 100644
index 000000000..eee07900b
--- /dev/null
+++ b/template-common/.htaccess
@@ -0,0 +1,2 @@
+Options -Indexes
+
diff --git a/include/pngfix.js b/template-common/pngfix.js
similarity index 100%
rename from include/pngfix.js
rename to template-common/pngfix.js
diff --git a/include/scripts.js b/template-common/scripts.js
similarity index 100%
rename from include/scripts.js
rename to template-common/scripts.js
diff --git a/template-extension/.htaccess b/template-extension/.htaccess
new file mode 100644
index 000000000..eee07900b
--- /dev/null
+++ b/template-extension/.htaccess
@@ -0,0 +1,2 @@
+Options -Indexes
+
diff --git a/template/.htaccess b/template/.htaccess
new file mode 100644
index 000000000..eee07900b
--- /dev/null
+++ b/template/.htaccess
@@ -0,0 +1,2 @@
+Options -Indexes
+
diff --git a/template/yoga/header.tpl b/template/yoga/header.tpl
index 1684c6cd1..06d47a827 100644
--- a/template/yoga/header.tpl
+++ b/template/yoga/header.tpl
@@ -22,7 +22,7 @@ the "text/nonsense" prevents gecko based browsers to load it -->
 <meta http-equiv="refresh" content="{REFRESH_TIME};url={U_REFRESH}">
 <!-- END refresh -->
 <title>{GALLERY_TITLE}:{PAGE_TITLE}</title>
-<script type="text/javascript" src="{pwg_root}include/scripts.js"></script>
+<script type="text/javascript" src="{pwg_root}template-common/scripts.js"></script>
 <!--[if lt IE 7]>
   <style>
     /* only because we need \{pwg_root\} otherwise use fix-ie5-ie6.css */
@@ -32,7 +32,7 @@ the "text/nonsense" prevents gecko based browsers to load it -->
     }
     FORM { behavior: url("{pwg_root}template-common/inputfix.htc"); }
   </style>
-  <script type="text/javascript" src="{pwg_root}include/pngfix.js"></script>
+  <script type="text/javascript" src="{pwg_root}template-common/pngfix.js"></script>
 <![endif]-->
 </head>