If you absolutely cannot separate out the public portion of the application from the core -- which should be possible because even the worst shared hosts allow for folders above public_html -- then you'll need to use a PHP solution for protection the files. For example if you define a constant in index.php and then check for that constant in included files you can prevent access, eg:

    defined('BASEPATH') OR exit('No direct script access allowed');

From https://github.com/EllisLab/CodeIgniter/blob/develop/applica...