PHP security prevents exposure of your source code or important configuration information

PHP security prevents exposure of your source code or important configuration information

The current project is to put all the contained files under the main directory, such:

The website directory is public. All the source code and configuration files except the entry file are stored in the website directory.
At the beginning, I didn't realize why I did this. I thought about it and it was really necessary. Otherwise, it would be easy to expose the source code and some important information:
(1) For example, configuration files with the. inc extension and other text files can be directly accessed in a browser. Many database accounts can be found here.
(2) If your apache does not support PHP, the PHP file will also access [Upgrade apache or modify configuration may appear] as a text type in the browser by default]
If you include your program outside the website directory, you can avoid the risk of retaining private information. Of course, you can configure apache to prohibit access to the. inc file in a browser:

<Files ~ "\. Inc $"> Order allow, deny Deny from all </Files>

Many similar details are easily forgotten by O & M personnel.