diff --git a/forum/README.md b/forum/README.md
index 457e91ec..2aa40aa5 100644
--- a/forum/README.md
+++ b/forum/README.md
@@ -56,6 +56,9 @@ are never served. This layout is tested in the local image.
 3. Give the user `http` write access to that folder and everything in it (File Station →
    Properties → Permissions, or `chown -R http:http` over SSH). Flarum writes `config.php`,
    `storage/` and `public/assets/`.
+   While the forum is copied but not installed, keep it closed: put the bundle's `.htaccess`
+   aside as `.htaccess.forum` and use a one-line `.htaccess` containing `Require all denied`.
+   Swap them back just before installing.
 4. Install. Either open the forum address and fill the installer (database, administrator), or
    over SSH, as `http`, in the forum folder: `php flarum install --file=install.yml` (format in
    `docker/entrypoint.sh`). Do not leave the folder online uninstalled: whoever opens the
@@ -64,7 +67,8 @@ are never served. This layout is tested in the local image.
    `php flarum extension:enable flarum-embed` and `oc-museum`). Tags is enabled by default.
 6. In the admin panel: e-mail settings (registration confirms addresses by e-mail), and a spam
    filter extension. Schedule a database dump.
-7. Import, over SSH in the forum folder (copy `import/machines.json` there first):
+7. Import, from a shell on the server (SSH, or a one-off Task Scheduler script run as `http`),
+   in the forum folder (copy `import/machines.json` there first):
 
        php flarum oc:import machines.json --site-url=https://barbel.synology.me/oldcomputers --map=forum.json