Vikings your main rival ? tbh I always thought y ' all hated the bears or packers more just because of proximity <| sep |> Many moons ago , and before the concept of MVC was a popular thing in the PHP world , not everyone used OOP in PHP . Some moons before that , PHP didn ' t even have the concept of objects , and most people mixed their HTML and PHP liberally . Many shared hosts also forced you put everything in the document root at least , they used to I haven ' t touched shared hosting in a blissfully long time . This , combined with bad coding , could sometimes mean that you could access admin areas and other sensitive things directly if you knew where the right files were . These days it ' s less of an issue more people use VPS ' s and other dedicated hosting methods . And most people use OOP with a front controller pattern , meaning that accessing most PHP files doesn ' t actually execute anything as they only contain class definitions . I personally still consider it best practice to put PHP code outside the document root primarily for the purpose of keeping the document root clean and making it clear what is and isn ' t accessible to visitors , but also because I think it ' s just best practice to not give people access to files they don ' t need access to . The most recent example I have encountered of this was at a previous company where crons would run PHP scripts using curl requests . One of these scripts was a newsletter , normally sent weekly . If developers want to test the newsletter , they ' d append certain GET parameters to the request and it would display the newsletter in the browser instead , or send it to a single specified email address . We got reports that the newsletters were going out too frequently . We discovered that our ISP was visiting every link we visited presumably for the purposes of contentbased blocking checking for malware or other dodgy content but without any GET parameters , triggering emails to be sent to the live list . While there are other resolutions to this the obvious being recording send dates in the database against users , or even using a proper mail service having the cron append a parameter to the script to tell it it ' s allowed to use the live list , this ultimately happened because the cron scripts were accessible from the web when they should not have been .