If you absolutely cannot separate out the public portion of the application from the core -- which should be possible because even the worst shared hosts allow

If you absolutely cannot separate out the public portion of the application from the core -- which should be possible because even the worst shared hosts allow for folders above public_html -- then you'll need to use a PHP solution for protection the files. For example if you define a constant in index.php and then check for that constant in included files you can prevent access, eg: defined('BASEPATH') OR exit('No direct script access allowed'); From https://github.com/EllisLab/CodeIgniter/blob/develop/application/controllers/Welcome.php https://github.com/EllisLab/CodeIgniter/blob/develop/applica...