Remember that the .htaccess Maker-generated .htaccess file will, by default, block web access to files on your site unless explicitly allowed.

I believe that the images which were blocked may have had an extension which was not in the "Frontend file types allowed in selected directories" and "Backend file types allowed in selected directories". Or they may had been in a directory that's not under one listed in the "Backend directories where file type exceptions are allowed" and "Frontend directories where file type exceptions are allowed" options.

The XML file would definitely be blocked unless you added the exceldiff folder in the "Allow direct access, except .php files, to these directories" option.

If you have no idea what I am talking about, stop and read the documentation of the .htaccess Maker feature of Admin Tools. Do that on a quiet afternoon, as it requires a bit of focus. A quick read-through won't help you much except establish the concepts. A second, more careful, read-through will help clarify what each option does.