Better way for securing direct access to php files
Your approach seems good to me. 

You can find some alternatives here, but most have downsides (not every server parses htaccess files, get_included_files is self-contained but works differently for different PHP versions, etc).

Additionally, you should think about moving everything outside the web-root that should not be accessible directly.

You might also want to rethink how you handle the error. Using an imperative in the error message gives the impression that the user can fix the error, which they can't. This might confuse legitimate users that accidentally accessed the script. So instead of Please do X, something like You can't access X would be better.

Ideally, you would handle the case of accessing an existing but forbidden PHP file exactly like a non-existing PHP file is handled (for example by showing a custom 404 error page).

And lastly, SECURE isn't that great of a name, as it's very generic. Something like IS_INCLUDED, NO_DIRECT_SCRIPT_ACCESS, or similar might be better.