Storing script files outside web root

Using .htaccess adds overhead since Apache has another item it needs to check for and process.

Keeping files out of web root isn't being paranoid, it's good practice. What happens if someone accesses one of the "include" files directly and it throws out revealing errors because all the pre-requisite files weren't loaded?

Each file needs to have it's own security checks to make sure it is running under the expected environment. Each executable file in a web accessible area is a potential security hole.

It really depends on what you have in your include_files. The most important thing is that you put any credentials you have outside of the document root ( database logins, etc ). Everything else really is secondary and doesn't matter that much.

If you don't want anyone stealing your source code then try to follow Zend conventions:

applicationlibrarypublic

DocumentRoot points to public and that just contains media files, js/css files. HTML/views, db logic, conf/credentials are in application. Third party libraries are in library.

Theoretically, if you just stick a .htaccess file in the folder, you could still have the .php files called directly.

Taking them out of the server root; however, keeps them from be accessed ever by someone who is browsing your website.