The answer from @Dog-eat-cat-world is a good start but you should avoid using .htaccess all together.
It is a huge performance killer and when using something other than Apache Httpd it might not even be used (like nginx).
It is better (and cleaner) to put this kind of restrictions inside your (virtual-)host config file. Also as for example Drupal recommends here do:
- turn off any options not needed
- Override the php handler to something nonexistent.
- Possibly disable the php engine completely.
Directly from ./sites/default/files/.htacces inside a working drupal 7 setup.
# Turn off all options we don't need.
# Set the catch-all handler to prevent scripts from being executed.
# Override the handler again if we're run later in the evaluation list.
# If we know how to do it safely, disable the PHP engine entirely.
php_flag engine off.