diff --git a/.htaccess b/.htaccess
index 3b6168c7..aaca1cef 100644
--- a/.htaccess
+++ b/.htaccess
@@ -1,3 +1,4 @@
+Options -Indexes
 AddDefaultCharset utf-8
 
 # Restrict access to Time Tracker only from certain IPs.
diff --git a/WEB-INF/.htaccess b/WEB-INF/.htaccess
new file mode 100644
index 00000000..14249c50
--- /dev/null
+++ b/WEB-INF/.htaccess
@@ -0,0 +1 @@
+Deny from all
\ No newline at end of file