I created an e-shop with e-books and they are stored in specific folder which is protected by a .htaccess file :
Order deny,allow deny from all allow from 127.0.0.1
The IP is the IP of the webpage, so it is inaccessible to anyone except for the scripts. I was thinking about adding .htpasswd, but it seems like overkill.
Is this enough to protect this folder?
Is it possible to spoof the IP so that sooner or later someone will find out the folder and how it is protected?