FYI, somebody in this thread or another thread recommended using the "internal" directive to protect the /xf/data directory.
You don't want to do that if you have Jaxel's [8wayRun.com] XenUtiles installed, as it saves the sitemaps it generates in that directory, and nobody (including google/bing) would be able to find them.