I moved just about everything below web root cept icons and images, and other browser side necesities. All directs go through index.php, nothing is referenced by directory publically.

/core/apps/[name of app]

/core/config/ (config files, PDF templates, etc.)

/core/inc/ [libraries/extensions]

/public_html/index.php

/public_html/info/ [icons, images, and other public accessible data]

mainly index.php has

$home = $_SERVER['SCRIPT_FILENAME'];

$loc = explode('/',$home);

define('CORE_BASE', implode('/',array_slice($loc,0,-2)).'/');

require_once core_BASE.'core/inc/main.php';

which defines the core path (below web root), then includes the main base code. From there all code is below web root.

note: css and javascript can be included directly (saves having browser request them anyway)