I've been reading up on server/apache security and I've run into a contradiction. I read that you shouldn't serve any files that aren't inside Apache's scope, but I've been told that you should keep files outside Apache's scope.
My current setup is:
Should I have website files outside of Apache? Any other server security tips are appreciated.