You can block access to your site’s wp-config file from browser by adding following code in your .htaccess file:
# Block access to wp-config
<files wp-config.php>
order allow,deny
deny from all
</files>
For blocking access to your .htaccess file add this code inside your .htaccess file:
# Block access to htaccess
<files .htaccess>
order allow,deny
deny from all
</files>
Note:.htaccess file is present in your site’s root at the same place where you find wp-config file.