The document root, which is also called the web root or website root directory, is the publicly-accessible base folder for a website. It is where you'll find the index file (index.php, index.html, default.html, etc). This folder is often named public_html, htdocs, www, or wwwroot, depending on your web host and settings.

The document root is the folder that is accessed when you navigate to the website's domain. For example, if you have a website www.mywebsite.com with an index.html file in the document root, navigating to that web address will serve that index file.

Above the Document Root

A website can keep files outside of the public document root. These files cannot be accessed by a URL or Web Address. They can only be accessed by the web application (PHP, ASP.NET, etc) through server-side programming and code.

Take a look at this example directory hierarchy for a simple PHP website:

mywebsite/
- application_files/
- library/
- templates/
- config.php
- public_html/
- media/
- image1.jpg
- image2.jpg
- includes/
- style.css
- script.js
- index.php
In the above example, the public_html folder is the document root of the website and index.php is what is ran when someone navigates to the website's domain (www.mywebsite.com). The files and folders in application_files cannot be accessed publicly, and are used solely by the PHP application.

Security

It is good practice to keep all non-public files outside of the document root. For example, you may have header.php and footer.php files that should not be accessed directly, but are included into the website by another file. Or you may have a config.php file containing your database login information. Keeping these files above the document root means they cannot be accessed publicly by a URL or Web Address (unless you create a script that specifically serves them).