I've been reading up on server/apache security and I've run into a contradiction. I read that you shouldn't serve any files that aren't inside Apache's scope, but I've been told that you should keep files outside Apache's scope.
My current setup is:
public_html/back, outside Apache's scope, which houses my PHP, database, and website backend files. All website directories and files have an owner/group of
www-data. I'm running this all on Free BSD.
Should I have website files outside of Apache? Any other server security tips are appreciated.