Codeigniter 4 security and best practices on live

The "document root" is a server term, and not configured inside your app.
With Apache, a common pracice is to setup a virtual host element for your app, eg DocumentRoot "/pub7/htdocs/course-hub/public"

I have seen some clever .htaccess rulesets to achieve this too, but they strike me as more complicated than the virtual host approach.