Another good tip here (suggested by one of our users):
I am testing… and here is what seems to work for me: folder/directory permission set to 700, file permission set to 400.
Only the plugin can access it.
BUT, please try it in different browsers and see if it works 100% ok.
Of course, adding the .htaccess is good too.