jd01 - 3:07 am on Oct 6, 2009 (gmt 0)

Actually, no, it was not truncated, because I've had upwards of 50 php files on a website and block any direct request to any of them... It's the code I actually use, because there is no reason anyone ever needs direct access to a php file on my sites... Everything either ends in .html or is extensionless and all are re-written.

It checks any .php request and then simply checks to see if it is an original request or internal-subrequest. If it's original I know you are venturing somewhere you should not be and block the access. I only need to know if the request is original or secondary (internal subrequest) to know what to do, so I don't need to worry too much about the method of the request or the exact file name if it ends in .php, all I need to know is 'original' or 'sub' request.

It's why I posted the caution on using it...
It blocks everything, except subrequests.

Acutally in looking closer, maybe I copied and pasted an older version of the code...
This is the most recent and works for sure:

RewriteCond %{THE_REQUEST} \.php
RewriteRule \.php$ - [G]