Forbid file but css/js/img etc. by htaccess

By FILE

<Files ~ "^.*">   # to all files/すべでのファイルに対する
  Deny from all    # forbid access/すべで禁止
</Files>

<Files ~ "^index\.php|css|js|.*\.png|.*\.jpg|.*\.gif">  # the kind of files/ファイルの種類
  Allow from all   # allow access/全部許可する
# Allow from [ip]  # allow from special ip or other/特定なIPなどからのみ許可
</Files>

In this way, you can still use include/fopen to get the css/js/png in php.