 <p>You would indeed use whatever server side configuration options are available to you.</p> <p>Depending on how your hosting is set up you could either modify the include path for PHP (<a href="http://php.net/manual/en/ini.core.php#ini.include-path" rel="nofollow noreferrer">http://php.net/manual/en/ini.core.php#ini.include-path</a>) or restricting the various documents/directories to specific hosts/subnets/no access in the Apache site configuration (<a href="https://httpd.apache.org/docs/2.4/howto/access.html" rel="nofollow noreferrer">https://httpd.apache.org/docs/2.4/howto/access.html</a>).</p> <p>If you are on shared hosting, this level of lock down isn't usually possible, so you are stuck with using the Apache rewrite rules using a combination of a easy to handle file naming convention (ie, classFoo.inc.php and classBar.inc.php), the .htaccess file and using the FilesMatch directive to block access to *.inc.php - <a href="http://www.askapache.com/htaccess/using-filesmatch-and-files-in-htaccess/" rel="nofollow noreferrer">http://www.askapache.com/htaccess/using-filesmatch-and-files-in-htaccess/</a></p> <p>FWIW all else being equal the Apache foundation says it is better/more efficient to do it in server side config vs. using .htaccess IF that option is available to you.</p>