Alias /xhprof /usr/share/xhprof/xhprof_html

<Directory /usr/share/xhprof/xhprof_html>
   # For security reason, the web interface
   # is only allowed from the server
   <IfModule mod_authz_core.c>
      # Apache 2.4
      Require local
   </IfModule>
   <IfModule !mod_authz_core.c>
      # Apache 2.2
      Order Deny,Allow
      Deny from All
      Allow from 127.0.0.1
      Allow from ::1
   </IfModule>
</Directory>