[chrishajer]

You don’t need to protect anything. All php files should be 0644 permissions, the directories should be 0755. Any file with a php file extension will be processed by PHP on the web server, so for something like the bb-config.php that does not return any content, the browser will not display any contents. A lot of php files with private information in them are like that, with no content returned.

Load this page:

http://www.autogas-umruestungen.de/forum/bb-config.php

There’s nothing displayed in the browser since the web server returns the processed output of the php file, not the source of the file.