Where to place PHP files for security?
Put in mind that there is no best place to store your files safely. The safety of your sensible files is only a result of a combination of good measures -such as preventing URL injections that may disclose your sensitive files- you may take and discussed below briefly.
My thought is it should follow the principle of least privilege, if
those files don't need to be public then they shouldn't be. Why is
this something that is not right at the start of PHP the right way?
Same question you could ask about why firewalls are not recommended. But the answer is that because the article you choosed is rather intended for developers. Developers are more worried on how to to make it work than how to make it safe. Look to the sections discussed through that article:
Getting Started (general setup , PHP versions to choose ...), Code Style Guide (Programming Paradigms, Namespaces, Standard PHP Library, Xdebug ...), Dependency Management, PEAR (installation and so on), Coding Practices, Dependency Injection (a software design pattern), Interacting with databases, Templating ...
As you can guess, this is addressed for developers not for the ones who are worried like you by security aspects of an application. The only section that speaks a little bit about security is Security, and within it may be only the subsection related to password hashing, data filtering and sanitization are important but still poorly covered.
Is there is a standard way of handling this?
The article you linked to states: There is no canonical way to use PHP. Same thing we can say: There is no canonical way to use PHP safely. This is said, the principle of least privilege you mentioned is a must and still there are good safety practices you need to follow because only a conjunction of these principles all together can give you a better assurance:
Defense in depth: you must resolve your problem in terms of layers of security: secure setup of Apache, safe coding style, firewall, effective .htaccess files ... While some argue that this principle adds complexity to your application and may bring new security risks, a smart application of this principle can keep your application simple but safe (for example: hashing passords allowing access to your folders is good, but salting them is better, peppering them in addition is even better).
Specify folder and files whitelist: Instead of listing folders and files that must not be accessed, you need to rather authorize access to your public files/folders and reject everything else because this way you won't forget protecting some sensible files.
- Least privilege: your resource permissions (files in your case, but you may consider other elements) must be granted at minimum level to users of your website
- Do not rely that much on security through obscurity to hide your files.
- Minimize the attack surface of your web application
- Detect intrustions: log security relevant information to identify the risks and protect your application
- Some think that a reputed hosting company is enough as an element to protect their application, but still you need to protect your application separately and independently from the hosting environment
- Do not rely only on third party actors to secure your application