On shared hosting, public_html is usually the folder mapped to your domain. If a file is inside it, assume a visitor may be able to request it directly by URL.
Keep configuration files, private notes, database exports, and raw backups outside public_html. If your host only gives you one visible folder, ask support where private files should live.
Do not leave old applications in subfolders. A disabled WordPress install or unused PHP tool can still be reachable and vulnerable if the files remain online.
Review public_html regularly. A clean folder makes suspicious files easier to spot and lowers the chance that a forgotten upload becomes a security issue.