I would just move the
includes folder out of the web-root, but if you want to block direct access to the whole includes folder, you can put a .htaccess file in that folder that contains just:deny from all
That way you cannot open any file from that folder, but you can include them in php without any problems.
In this htaccess tutorial, we are going to show how you can prevent the direct access of file/URL of your website. Sometimes website owner doesn’t want that user can access their zip, CSS, etc file directly.
To prevent the direct access, you need to add the below script in the
.htaccess file.
.htaccess
RewriteEngine on
# script to stop direct link of zip and css file
RewriteCond %{HTTP_REFERER} !^http://(www\.)?example[NC]
RewriteCond %{HTTP_REFERER} !^http://(www\.)?example.*$ [NC]
RewriteRule \.(zip|css)$ http://www.example.com[R,L]
You can add multiple file extensions by ORing the
pipe(|) symbol.(gif|zip|png|js|css|bmp)
