To prevent direct access to .tpl files in your WHMCS installation, you can add a rule to your .htaccess file. This will block anyone from accessing your .tpl template...
Basic guides for setting up and using WHMCS
