I moved just about everything below web root cept icons and images, and other browser side necesities. All directs go through index.php, nothing is referenced by directory publically.
/core/apps/[name of app]
/core/config/ (config files, PDF templates, etc.)
/core/inc/ [libraries/extensions]
/public_html/index.php
/public_html/info/ [icons, images, and other public accessible data]
mainly index.php has
$home = $_SERVER['SCRIPT_FILENAME'];
$loc = explode('/',$home);
define('CORE_BASE', implode('/',array_slice($loc,0,-2)).'/');
require_once core_BASE.'core/inc/main.php';
which defines the core path (below web root), then includes the main base code. From there all code is below web root.
note: css and javascript can be included directly (saves having browser request them anyway)