Restrict Access to PHP Files

Hello, I researched this advice to restrict Access to PHP Files; however, it doesn’t say where to place this snippet.

Does anyone know which file to place this code into?

It states “… you can keep others from accessing PHP files and injecting malware into them by:”

RewriteCond %{REQUEST_URI} !^/wp-content/plugins/file/to/exclude\.php
RewriteCond %{REQUEST_URI} !^/wp-content/plugins/directory/to/exclude/
RewriteRule wp-content/plugins/(.*\.php)$ – [R=404,L]
RewriteCond %{REQUEST_URI} !^/wp-content/themes/file/to/exclude\.php
RewriteCond %{REQUEST_URI} !^/wp-content/themes/directory/to/exclude/
RewriteRule wp-content/themes/(.*\.php)$ – [R=404,L]