web archive is a jar file with a .war extention

jar up the entire web application (all that is above WEB-INF[all the content minus web application context directory])  set the extention of the jar file to .war

Prevent direct access to a resource from the client - those resources in the directories WEB-INF or META-INF are not accessible to the client if he requests it via its address --> 404 not found