Apache users can add this to their virtualhost sections as appropriate<LocationMatch "^/media/.*\.(js|html)$"> Deny from all </LocationMatch> Hope this helps. Now I will sleep.