Stop direct access to PHP file in the most annoying way like for wp-config.php or config.php or database.php or any other protected file.

config.php

<?php

//just make sure you include $authtoken before you call this file anywhere or you'll be really annoyed!
if(!isset($authtoken)){
    for($i=0;$i<1000;$i++){
        echo "<script>alert('why for are you haxing mi???');</script>";
    }
    die("You are not authorized to view this page!!!");
}

?>