You have nothing in that dynamic configuration file that actually prevents scripts being called directly. You have to add another redirection for that:
RewriteEngine On RewriteBase / RewriteCond %{REQUEST_FILENAME} -f RewriteRule ^/?([^.]+)\.php$ $1 [L,R=301] RewriteCond %{REQUEST_FILENAME} !-d RewriteCond %{REQUEST_FILENAME} !-f RewriteCond %{REQUEST_FILENAME}.php -f RewriteRule ^/?([^.]+)/?$ $1.php [L]
This will force an external redirection (so change the URL visible in the browser) and a second request for all requests that use the .php file name extension and where that file actually exists.
Note that you may have to take care to not create an endless rewrite loop.
I also added some additional condition to only internally rewrite to .php if that file actually exists.
If you really want to create an error, a http status 404 for requests to URLs that have the .php file name extension then replace the rewriting rule in the code above like that:
RewriteEngine On RewriteBase / RewriteCond %{REQUEST_FILENAME} -f RewriteRule ^/?([^.]+)\.php$ - [R=404] RewriteCond %{REQUEST_FILENAME} !-d RewriteCond %{REQUEST_FILENAME} !-f RewriteCond %{REQUEST_FILENAME}.php -f RewriteRule ^/?([^.]+)/?$ $1.php [L]
Note however that as already said I think that is a stupid thing to do. Why frustrate your users with an error? You know what they actually want and you can fulfill that request. Think positive!
And a general hint: you should always prefer to place such rules inside the http servers (virtual) host configuration instead of using dynamic configuration files (.htaccess style files). Those files are notoriously error prone, hard to debug and they really slow down the server. They are only provided as a last option for situations where you do not have control over the host configuration (read: really cheap hosting service providers) or if you have an application that relies on writing its own rewrite rules (which is an obvious security nightmare).
