How do I restrict access to the install.php file
In apache vhost:

RedirectMatch 403     "/(install|update).php" 


Or in htaccess change the part on top:

# Protect files and directories from prying eyes.
&lt;FilesMatch "\.(engine|inc|info|install|make|module|profile|test|po|sh|.*sql|theme|twig|tpl(\.php)?|xtmpl|yml)(~|\.sw[op]|\.bak|\.orig|\.save)?$|^(\.(?!well-known).*|Entries.*|Repository|Root|Tag|Template|composer\.(json|lock)|web\.config)$|cron\.php|install\.php|update\.php|^(CHANGELOG|COPYRIGHT|INSTALL.*|LICENSE|MAINTAINERS|README|UPDATE).txt$|^#.*#$|\.php(~|\.sw[op]|\.bak|\.orig|\.save)$"&gt;


Please note this htaccess also protects access to cron.php, update.php, web.config and txt files like /core/CHANGELOG.txt