diff --git a/conststr.php b/conststr.php
index 550bc65..65a3dea 100644
--- a/conststr.php
+++ b/conststr.php
@@ -72,6 +72,7 @@ $constStr = [
             'downloadencrypt' => '0 or 1. if 1, the files in encrypt folder can be downloaded without password',
             'background' => 'Set an url as background photo, or put a \'background.jpg\' at showed path.',
             'guestup_path' => 'Set guest upload dir, before set this, the files in this dir will show as normal.',
+            'hideFunctionalityFile' => '0 or 1. if 1, some file will not show in list to guest, like readme.md',
             'passfile' => 'The password of dir will save in this file.',
             'public_path' => 'Show this Onedrive dir when through the long url of API Gateway; public show files less than private.',
             'sitename' => 'sitename',
@@ -86,6 +87,7 @@ $constStr = [
             'downloadencrypt' => '0 或 1。如果 1, 那加密目录内的文件可以不需要密码就能下载。',
             'background' => '设置一个url作为背景，或者在你显示的目录放一个background.jpg文件。',
             'guestup_path' => '设置游客上传路径（图床路径），不设置这个值时该目录内容会正常列文件出来，设置后只有上传界面，不显示其中文件（登录后显示）。',
+            'hideFunctionalityFile' => '0 或 1。如果 1, 某些文件不列表给游客看，但它的功能正常，比如readme.md',
             'passfile' => '自定义密码文件的名字，可以是\'pppppp\'，也可以是\'aaaa.txt\'等等；列目录时不会显示，只有知道密码才能查看或下载此文件。密码是这个文件的内容，可以空格、可以中文；',
             'public_path' => '使用API长链接访问时，显示网盘文件的路径，不设置时默认为根目录；不能是private_path的上级（public看到的不能比private多，要么看到的就不一样）。',
             'sitename' => '网站的名称',
diff --git a/function/common.php b/function/common.php
index c303652..7bd8336 100644
--- a/function/common.php
+++ b/function/common.php
@@ -12,6 +12,7 @@ $Base64Env = [
     //'disktag',
     //'downloadencrypt',
     //'function_name', // used in heroku.
+    //'hideFunctionalityFile',
     //'language',
     //'passfile',
     'sitename',
@@ -36,6 +37,7 @@ $CommonEnv = [
     'background',
     'disktag',
     'function_name', // used in heroku.
+    'hideFunctionalityFile',
     'language',
     'passfile',
     'sitename',
@@ -52,6 +54,7 @@ $ShowedCommonEnv = [
     'background',
     //'disktag',
     //'function_name', // used in heroku.
+    'hideFunctionalityFile',
     'language',
     'passfile',
     'sitename',
@@ -84,6 +87,20 @@ $ShowedInnerEnv = [
     //'token_expires',
 ];
 
+function isHideFile($name)
+{
+    $FunctionalityFile = [
+        'head.md',
+        'readme.md',
+        'favicon.ico',
+    ];
+
+    if ($name == getConfig('passfile')) return true;
+    if (substr($name,0,1) == '.') return true;
+    if (getConfig('hideFunctionalityFile')) if (in_array(strtolower($name), $FunctionalityFile)) return true;
+    return false;
+}
+
 function getcache($str)
 {
     //$cache = null;
@@ -502,6 +519,7 @@ function main($path)
         $_SERVER['disktag'] = $path;
         $pos = strpos($path, '/');
         if ($pos>1) $_SERVER['disktag'] = substr($path, 0, $pos);
+        if (!in_array($_SERVER['disktag'], $disktags)) return message('Please visit from <a href="'.$_SERVER['base_path'].'">Home Page</a>.', 'Error', 404);
         $path = substr($path, strlen('/'.$_SERVER['disktag']));
         if ($_SERVER['disktag']!='') $_SERVER['base_disk_path'] = path_format($_SERVER['base_disk_path']. '/' . $_SERVER['disktag'] . '/');
     } else $_SERVER['disktag'] = $disktags[0];
diff --git a/theme/classic.php b/theme/classic.php
index 766de04..21ad4dd 100644
--- a/theme/classic.php
+++ b/theme/classic.php
@@ -244,13 +244,13 @@
                     foreach ($files['children'] as $file) {
                         // Files
                         if (isset($file['file'])) {
-                            if ($_SERVER['admin'] or (substr($file['name'],0,1) !== '.' and $file['name'] !== getConfig('passfile') ) ) {
-                                if (strtolower($file['name']) === 'head.md') $head = $file;
-                                if (strtolower($file['name']) === 'readme.md') $readme = $file;
-                                if (strtolower($file['name']) === 'index.html' && !$_SERVER['admin']) {
-                                    $html = curl_request(fetch_files(spurlencode(path_format($path . '/' .$file['name']),'/'))['@microsoft.graph.downloadUrl'])['body'];
-                                    return output($html,200);
-                                }
+                            if (strtolower($file['name']) === 'head.md') $head = $file;
+                            if (strtolower($file['name']) === 'readme.md') $readme = $file;
+                            if (strtolower($file['name']) === 'index.html' && !$_SERVER['admin']) {
+                                $html = curl_request(fetch_files(spurlencode(path_format($path . '/' .$file['name']),'/'))['@microsoft.graph.downloadUrl'])['body'];
+                                return output($html,200);
+                            }
+                            if ($_SERVER['admin'] or !isHideFile($file['name'])) {
                                 $filenum++; ?>
                     <tr data-to id="tr<?php echo $filenum;?>">
                         <td class="file">