Security configuration for lighttpd webserver

Unfortunately lighttpd does not support .htaccess, so the current security configuration of the module does not work with it. As far as I know there is no way to do it automatically either (with a file in the directory), so the following should be put by the user to the global lighttpd configuration file:

$HTTP["url"] =~ "/files/backup_migrate/" {
url.access-deny = ("")
}

Could you add this to the documentation?

Also, when the security test fails, it would be very useful to include this information (fancy way: only after testing if the webserver name matches lighttpd), or alternatively include a link to the relevant documentation.