Comment by codedokode

> One misconfigured .htaccess

First, I hope nobody is using Apache anymore, second, you typically store files outside of web directory.