Method 1 - modify apache conf or .htaccess order allow,deny deny from all Method 2 - Store them in a file outside web root. e.g: include('../private/db.php') Better approach is Method 1 + 2 :)