Always use virtual directories and it's as safe as anything else. If you call your vfp web mtdll from asp or asp.net, I would say the security is as good or even better than those native systems(ASP, ASP.NET). Might be better since VFP dbfs and how vfp mtdlls work are not generally known as well as the major web technologies to web hackers...