protect file access outside webroot

If I want to protect document from being directly accessed from the web and only allow them to be served by a file, what's the best location to upload them? Currently I upload them the htsdata directory, is this the best location? Thanks. Dave HTC Disclaimer: The information contained in this message may be privileged and confidential and protected from disclosure. If the reader of this message is not the intended recipient, or an employee or agent responsible for delivering this message to the intended recipient, you are hereby notified that any dissemination, distribution or copying of this communication is strictly prohibited. If you have received this communication in error, please notify us immediately by replying to the message and deleting it from your computer. Thank you.