Prevent direct access to core  files

I suggest preventing direct access to core files by checking one of the defined constant in the index.php - 'CMS_ROOT'- for example-- if defined or not, if not defined then stop execution
eg:
In the top of every file put the following:
<code>if ( ! defined('CMS_ROOT')) exit('No direct script access allowed');</code>