Why must the private directory stay outside public web access?
The private tree can contain configuration or protected files that should never be served directly by the web server.
Updated September 28, 2026
Public and private have different jobs
public_html contains files a browser may request. The sibling private tree is for protected application storage.
If your host forces everything under the public document root, stop and resolve that hosting layout before installing sensitive features.