Better way for securing direct access to php files I don't know if this method uses a lot of time to process, or if it is bad but I wanted to know if there is any better way of actually doing this? I have a few class files that I want to stop users viewing through the browser, and only allowing them to view it if actually load it from the index.php

So I have this nice little piece of code.

In my index.php I have:

define("SECURE", true);


And I check if it has been defined in class files using 

defined("SECURE") or exit('Please define variable SECURE to continue.');


So when they visit class files it actually blocks them from viewing it unless they have loaded index.php first.

Any better way?
Your approach seems good to me. 

You can find some alternatives here, but most have downsides (not every server parses htaccess files, get_included_files is self-contained but works differently for different PHP versions, etc).

Additionally, you should think about moving everything outside the web-root that should not be accessible directly.

You might also want to rethink how you handle the error. Using an imperative in the error message gives the impression that the user can fix the error, which they can't. This might confuse legitimate users that accidentally accessed the script. So instead of Please do X, something like You can't access X would be better.

Ideally, you would handle the case of accessing an existing but forbidden PHP file exactly like a non-existing PHP file is handled (for example by showing a custom 404 error page).

And lastly, SECURE isn't that great of a name, as it's very generic. Something like IS_INCLUDED, NO_DIRECT_SCRIPT_ACCESS, or similar might be better.