The technique for protecting sensitive files from direct HTTP access is to put them above the root directory and access them with PHP based on certain conditions (e.g. user's credentials) as C3roe explained. Thank you, C3roe!