Keep it simple! All files (.html/.php/.inc) with HTML under $DOC_ROOT All non-HTML files, somewhere else No direct access to .inc Order allow,deny Deny from all ]]>