You can write your .htaccess file
<Files filename.php>
order allow,deny
deny from all
</Files>
or hide all files with ext:
IndexIgnore *.php *.jpg
or protect file:
<Files "filename.php">
AuthType Basic
AuthUserFile "/path/to/your/htpasswd/file/.htpasswd"
AuthName "webFileBrowser"
Require...