Executing PHP code throught a protected directory on IIS...

I have restricted the IP Address etc through the directory security, if i goto: www.domain.com/thedir/ it does indeed give me the ip denied, howver if i goto a file within it if it's a basic html page it displayes it, similarly if it's a PHP script it also gets executed... (I know if I was using Apache it'd be a simple .htaccess file, but the client requires it on IIS.) I obviously want to dissallow this, so that any of the modules cannot be executed if somone happens to take an informed guess as to the location of things... Any help would be much appreciated...