You should block access in php file.

For example:
You define using defined ( 'ACCESS'... in any file you want direct access and put the line below to every php files:
defined ( 'ACCESS' ) or die ( 'Restricted Access' );

http://www.vnbooking.com