To disable the direct access to xml and ini files, just add the following codes to your server root htaccess file: <FilesMatch “.(ini|xml)$”> order allow,deny deny from all </FilesMatch>