As a matter of fact, you can combine the two. I was going to mention it before, but decided to keep to the basics.
Step 1: Create the PHP file mentioned above. It doesn’t matter where the file is located, put it somewhere that makes sense with your site layout and give it a descriptive name (eg, forbidden.php). You can put it in your root directory, but I tend to put supporting files (ie, non-content-related) into a specific place. But it doesn’t matter.
Step 2: Leave that first line in .htaccess and add another one below it reading:
ErrorDocument 403 /path/to/forbidden.php
So if you put that PHP file in the root directory, the path would be /forbidden.php. If it’s in a directory called “stuff”, it would be /stuff/forbidden.php. And so on.
Step 3: That’s it, there is no step three.
The result will be that the web server will return an error to anyone looking in these directories, and serve up the custom error page specified in the ErrorDocument line. Because the specified error document is the PHP redirect script, they will be redirected back to your front page. This will work for any directory without an index file.
I used “good” as opposed to bad. “Correct” might have been a better word. On Unix systems, files beginning with a dot are hidden.