[eluser]rogierb[/eluser]
-- system folder
-- application folder
-- secure documents
-- public domain
-- -- css
-- -- img
-- -- js
-- -- downloads
-- -- documents
-- -- index.php
something like the above is ok. You leave css, js, images and everything that is freely accessible.
Everything that has to be secured you put above the public domain.