All elements that are shown to all the users must be moved away from backend folder (which is password-protected).
Should be fixed, already
Should be fixed, already