The easy way to protect one Folder
is to put one .htaccess file inside the folder
with this in the .htaccess
Deny from all
Your php scripts can still get stuff, like include, from the folder,
but nobody else can get to or see anything in that directory.