Just like we can deny access to readme.html, it’s possible to deny public access to wp-config.php using the .htaccess file. But, before doing this, ask yourself this question:
Is your blog installed in the /public_html folder?
If it is, then instead of using .htaccess to prevent public access to the file, it’d probably be better to move the wp-config.php file.
For everyone else, add the following code to the .htaccess file thats in the same directory as your wp-config.php file.
# protect wp-config.php
<files wp-config.php>
Order deny,allow
deny from all
</files>