# don't allow people to retrieve php files
<FilesMatch ^(.*\.php)$>
  deny from all
</FilesMatch>