I found a simpler solution to the one I just posted: No need to move the farm's pub/ directory. Just place an .htaccess file with Order Deny, Allow Deny from All into the farm's root directory, and put another .htaccess file with Allow from All into the farm's pub/ directory. Best, ~Hans