config.php should not be in the web root