How do I protect my Access database (MDB file)?

Many people upload their MDB files to the same folder as their ASP files. Then they think about it a bit, and assume they *need* to create a DSN to put the MDB file outside of the web folder and refer to it with a local path. This is certainly one way to prevent people from downloading your Access database, but it is not likely the best. For one, a DSN is less efficient, and you can use a non-web path in a DSN-less connection string anyway (see Article #2126 for more information). Next, you're going to have a hard time updating your database struture if you need physical access to the local file system in order to see the file at all.  
 
Yes, you could set an FTP site to service that folder, but if you think FTP is any more secure than making someone guess the location and filename, you're kidding yourself. 
 
Which brings me to my next point. Unless you name your database "database.mdb", I doubt very much that anyone would be able to find it. Now, I'm no big fan of security through obscurity, but you're always going to have trade-offs. If you name your database file FHQWHGADS.mdb, then it's probably pretty safe from anything but a raw dictionary attack, unless they had physical access to the server (in which case local vs. web folder wouldn't have saved you anyway). 
 
You might have imagined that those would be all of your options, but I think the best compromise is similar to protection of #include files; name your database file something like FHQWHGADS.asp. This way, even if someone were to guess the location, if they typed it in the browser and tried to download it, they'd get nothing but garbage since IIS will try to process it as an ASP file. The Access interface itself has no issues saving or opening an MDB file with any other extension. 
 
Thanks to Strong Bad for the name "FHQWHGADS"... don't forget to click on the boombox when the skit is over.