diff --git a/Installation-instructions.md b/Installation-instructions.md
index ebb98af..9dd953d 100644
--- a/Installation-instructions.md
+++ b/Installation-instructions.md
@@ -58,6 +58,19 @@ chown -R www-data:www-data /var/www/webmail
 www.yourdomain.com/webmail?admin
 ```
 
+### Secure `data` folder
+You can move the `data` folder outside public http access for security.
+1. Rename /var/www/webmail/_include.php to /var/www/webmail/include.php
+2. Edit include.php and in there set the new APP_DATA_FOLDER_PATH. Like:
+```php
+/**
+ * Custom 'data' folder path
+ */
+//define('APP_DATA_FOLDER_PATH', dirname(__DIR__) . '/snappymail-data/');
+//define('APP_DATA_FOLDER_PATH', '/var/external-snappymail-data-folder/');
+define('APP_DATA_FOLDER_PATH', '/var/external-snappymail-data-folder/');
+```
+
 ### GPG verify
 The GPG key to verify a package can be found at several places:
 * https://keyserver.ubuntu.com Hockeypuck OpenPGP keyserver