For @Admin when he comes
Protected Dir / privacy
I think that by default, your script should put the Options +Indexes code in .htaccess
because otherwise, it makes no sense because it leads to 403 (because the server no longer displays the dir listing by default)
or make a checkbox in the options for protected dir that will be ON by default, unless someone really doesn’t want to have a dir listing, so let them remove the tick manually.