Using a private folder is a good practice (and should be the default in my opinion, even if some shared hosting does not support this). The documentation on this is pretty good but I think you should add that we need to move the .htaccess and the asset folder.
Perhaps simply show the file structure alongside with the configuration. It’s certainly trivial for people that know Kirby, but perhaps not for your first install.
Thanks for your feedback!
The assets folder needs to be publicly accessible and cannot be moved out of the document root.
I’m afraid we cannot make this the default, as many projects live on shared hosting where it is not possible to move stuff out of the document root.
I agree with the original poster that the documentation on the subject could be more thorough.
I’ve been dabbling with Kirby every now and then, the product feels great, but I’m not a dev, just trying to get the hang of this and I could really use some more instructions.
Now I’d like to start to build a new site, and from what I’ve understood, it would be more secure to put the files outside the public_html folder my hosting provider offers, right? Except for the index.php and the assets folder and the .htaccess file, they would need to reside in the public_html folder?
I tried to do that with the starter kit, but couldn’t figure out, what to exactly write in the index.php.
I’d appreciate a diagram of the file structure, plus instructions. For me, the current custom folder setup guide is quite spartan. I believe many other users would benefit from this, too.
This repo has a bit more, but is a good example of a public folder setup:
Note that such a setup is usually not possible on shared hosting, where you can’t put stuff outside the webroot. So this usually requires you to set up your Virtual hosts on your own server/VPS/cloud instance.
Thanks. It works now. So everything else is outside the public folder, but index.php and .htaccess and the assets folder are inside it. For anyone else using that linked stuff as an example: I just had to edit the include path in index.php so that it’s ”…/kirby/vendor/autoload.php” instead of only ”…/vendor/autoload.php”. The same way as it is in the actual Kirby documentation linked in the first post.
I tried setting up Kirby recently and found the documentation regarding public-private setup is still lacking. 
So I created this guide on Medium based on what I learned from these forums and my experience applying it to hosting with Hostinger.
Would love some feedback on it to make sure I’ve understood the setup correctly. 
Also I noticed that the public-private setup makes GitHub integration more of a hassle with hosting providers than if only using the public folder setup.
Can someone please clarify the importance of the public-private setup? Is it a general good practice for all Kirby sites? Or only really needed for certain use cases? (And if so, what would those use cases be?)