You may password protect the web directory with an .htaccess file for example or change the permissions of the web directory so the apache user has no permissions to read the files inside.