<FilesMatch "\.(xml|phtml)$">
    Deny from all
</FilesMatch>