How can prevent direct access to the files like the folders/files in application ?

I see in application folder are files .htaccess and index.html that include :

.htaccess

```
<IfModule authz_core_module>
Require all denied
</IfModule>
<IfModule !authz_core_module>
 Deny from all
</IfModule>

```

index.html

```
<!DOCTYPE html>
<html>
<head>
    <title>403 Forbidden</title>
</head>
<body>

<p>Directory access is forbidden.</p>

</body>
</html>

```

i create a new folder in a root project directory with name: Customers where will be stored customers PDF files . I paste both files .htaccess and index.html from application to Customers but the PDF files are still able to direct access .

How to make them like application folder files to be able to access only the system ?