protect files

.htaccess.sample

@@ -1,13 +1,29 @@
 RewriteEngine On
 RewriteBase /
 
-## SSL
-# Enforce SSL
+# SSL Enforement
 RewriteCond %{SERVER_PORT}     !^443$
 RewriteRule (.*)  https://%{SERVER_NAME}%{REQUEST}
 
-## Basic Auth protection
+# Basic Auth protection
 AuthType Basic
 AuthName "secured area"
 AuthUserFile /path/to/.htpasswd
 require valid-user
+
+# Protect every file excluding CSS, JS, PHP and HTML
+<Files *>
+  Order Deny,Allow
+  Deny from all
+</Files>
+
+<FilesMatch ^$>
+  Order Allow,Deny
+  Allow from all
+</FilesMatch>
+
+<FilesMatch "\.(css|js|php|html)$">
+  Order Allow,Deny
+  Allow from all
+</FilesMatch>
+