Question

From a book

A common convention is to use .inc for all include files. However,
this potentially exposes you to a major security risk because most
servers treat .inc files as plain text. Let’s say an include file
contains the username and password to your database, and you store the
file with an .inc filename extension within your website’s root
folder. Anyone who discovers the name of the file can simply type the
URL in a browser address bar, and the browser will obligingly display
all your secret details!

But i found there are some .inc files in the include file in a programme eg:drupal and some other programmes,why?how they prevent the inc file from being accessed from the browser?

Answer 1

.htaccess can be set to not allow web user requests to resources.

See this link

and in particular the section reading…

<Files ~ "\.(inc)$">
order allow,deny
deny from all
</Files>