I would like as much as possible of the php source moved out of the webroot. e.g. to ../

All day long bots are firing queries and POSTs at any and all php files causing massive server load and security headaches.

Just include them from the core and route to them via the core, taking care of sanitation in the process preferably.