In the latest trunk of the framework, we are able to move the protected folder in an application outside your web server root directory. Let’s say you have a structure as below:

www/
    superapp/
        proctected/
            index.php
            global/

To move it outside the WWW folder:

     superapp/
        proctected/

    www/
        superapp/
            index.php
            global/

Just change the configs after you move your files, SITE_PATH setting

//original
C:/wamp/www/superapp/

//changes
C:/wamp/superapp/

If you don’t wish to keep the name protected and wanted everything under superapp, try this:

    superapp/
        view/
        controller/
        .....
    www/
        superapp/
            index.php
            global/

Add on a new setting to common.conf.php, PROTECTED_FOLDER:

$config['PROTECTED_FOLDER'] = '';