PHP files in the root project directory are directly accessible

[adam-buckley]

I.e. go to [localhost]/config.php

This is also why most frameworks have the index.php in a public folder and then put all other files in the directory above it, they are then inaccessible