I've read that you can put php files outside of the document root of virtual hosts and that it can prevent people from accessing the .php files as well as prevent people from being able to download the php if the server messes up badly. Also seems like it may be easier than messing with a bunch of slow loading .htaccess files. So let's say my website's apache is setup like:
<VirtualHost *:80> ServerAdmin webmaster@localhost DocumentRoot /var/www/sitehtml </VirtualHost>
Is it good practice to keep .php files outside of the sitehtml directory that is served up to visitors and try to keep them in the sitephp directory?
Are there any downsides to doing it this way compared to keeping everything in sitehtml?