I've been trying to improve my sites security as I build a Drupal 8 update for my page. One thing I've seen recently is keeping your core code outside the web accessible docroot folder. I've also heard about keeping a copy of the code setup on git so you can easily bring down a clean copy if somehow someone changes something.
What is the current best practice for such a thing? On my server I have an account for the page, within which is public_html where anything actually being sent out to the world is kept. Is it possible to have the Drupal code one level down and then have things run from public_html?