W4-Server only knows two commands : GET and POST
Any other command will be ignored. So there are no backdoors. A HTTPD doesn't need more than
those commands, so it doesn't accept other commands (for the safety of your files).
Also we didn't make any passwords for you in W4-Server. We think passwords are dangerous and can only be stolen. The only way to access files from your server that are not in the DOCS directory is to take a seat behind the server computer. So there are no passwords to control the server from another place than behind the servercomputer.
No files can be sent to W4-Server, only forms that are filled out and sent back can be processed by a WTDP-file. So again the server decides what happens with the data on the server-machine. When the format of a form that has been sent back isn't recognized bij the WTDP-file it will be ignored. When it is recognized, the WTDP-file will act the way you programmed it.