.htaccess and virtual host configuration for WP in its own directory

Question

I've been taking a look at the modern WP development approaches using Composer and so on, for example Bedrock or WordPress-Skeleton.

I'd like to adapt these approaches ad create my own WP boilerplate, so I ended up with a project structure like this:

my_project
 |
 \--app  <-- custom wp-content folder
 |   |  
 |   \--mu-plugins
 |   \--plugins
 |   \--themes
 |
 \--vendor  <-- folder for composer packages
 |   |
 |   \...
 |
 \--wp  <-- WordPress core folder
 |   |
 |   \...
 |
 |--composer.json
 |--composer.lock
 |--index.php
 |--wp-config-local.php
 |--wp-config.php

Everything works fine so far, but the problem is that I have to set my_project as the web root folder, so that an user can go to http:/my-project/vendor, for example, and see all my vendor packages, which I think it's not good...

So, is there any way to set some .htaccess file or configure the virtual host in such a way that I can use that folder structure but do not allow anybody to access all those files and folders that are not absolutely necessary for the site...

Answer 1

Eventually I solved it by moving my app/ folder and my wp/ folder into a subfolder, which becomes the web root.

Something like this:

my_project
 |
 \--vendor  <-- folder for composer packages
 |   |
 |   \...
 |
 \--wordpress  <-- Web Root
 |   |
 |   \--app  <-- custom wp-content folder
 |   |    |  
 |   |    \--mu-plugins
 |   |    \--plugins
 |   |    \--themes
 |   |
 |   \--core  <-- WordPress core code
 |
 |--all the other stuff like config, environment variables, SASS, Grunt, etc... outside the web root