Yii2 - prevent access to specific files like controller

How can i prevent access to files like model or controller using yii options without writing a very big .htaccess

None of the framework files will be accessible from a http request if you set up the server correctly.

In Yii2 the DOCUMENT ROOT points to the ~/backend/web and ~/frontend/web subdirs respectively, where only index.php and static files should be (notably the auto-generated assets folder).