Your root web directory is the public_html folder.

Any and all files that you want to have web access to, whether password protected or not, should be put in the folder.

Yes, you can put files outside of the public_html folder, however, they will not be accessable via a web browser.

You will find other directories that are outside of the public_html folder. These directories contain special files and should not be altered.