Another answer would be to make the names of the files hideously complicated and non sequential. Thus if he wanted to load the first file, 'File1' then fine, but he would presume that the second file would be 'File2' not 'DannyBoyK4ZqZarniwoop' or some such thing. ------------------------------------ I will never again mention that I was the poster of the One Millionth Lounge Post, nor that it was complete drivel. Dalek Dave CCC Link[^] Trolls[^]

You accomplish this by keeping your assets in a non-accessible location (eg, somewhere in App_Data) and using an HttpHandler to serve the files out after verifying permissions.