Neil, I did not try the 'Options -Indexes', but I found out that one .htaccess file in the farm directory is enough and protects the whole subdirectory tree. No need for peppering :) Best, ~Hans