My webapp has a buch of modules. Each module has a \'main\' php script which loads submodules based on a query sent to the main module:
//file: clientes.php
For the sake of completeness, the other possibility is to move such files to a directory that's not publicly available. However, some control panels used by hosting providers make this impossible. In such case, if you are using Apache you can place an .htaccess file inside the directory:
#
# Private directory
#
Order allow,deny
Deny from all