How to secure config?

[toplisek]

I need to know if this will work:
as an example .htaccess file that would prevent access to the config.php. I would place this file within your /includes directory.

<Files config.php>
order deny
</Files>
Is this correct and how opposite?

[jdMorgan]

This will make config.php inaccessible from HTTP, as long as config.php exists as a real file (and not as an Aliased path) in your filespace:

<Files config.php>
Order deny,allow
Deny from all
</Files> 

See Apache mod_access documentation for details.

Jim