I am testing a simple site in Windows, XAMPP. There, I use some PHP files that must not be accessed directly for security reasons. After looking around, there are many methods to do this. The simplest seems to be define a constant and exit if it's not defined. While this works, I am looking for a more robust approach.
For this reason I decided to make my files not available to the web by putting them in a directory user's can't access from a browser.
Question: what's the recommended way to do this security and performance wise?
I am aware of 2 methods:
a) putting my files in
b) modifying the htaccess file somehow