I have a .htaccess file in directories that the UBB does not embed files from that is:
# Start .htaccess file #
# Deny viewing of .htaccess #
<Files .htaccess>
order allow,deny
deny from all
</Files>
# Don't Allow Access #
AuthType Basic
AuthName "Access Denied"
Require valid-user
# End of .htaccess file #
As there is no user listing it will always deny browsing of the directory. I use this all over my CMS, you'll find through trial and error where to place it (if it pops up when browsing your forums, then you have it in a folder that we're calling files from, such as the libs folder).