docs: add note for index.php change

[kenjis]

Description
I saw a YouTube video that a dev had moved index.php to the project root.
Also this description is on the README file, but not in the User Guide upgrading section.

aChecklist:

• Securely signed commits
• [] Component(s) with PHPDoc blocks, only if necessary or adds value
• [] Unit testing, with >80% coverage
• User guide updated
• [] Conforms to style guide

[datamweb]

The internet is full of these types of videos, I am shocked every time I see them.
It seems that because shared hosts are used, it is practically not possible to set Document Root
from cPanel or etc . So they have to do this.
It is better to link these explanations together with the explanations given in Shared Hosts.

[kenjis]

I added a link to a forum article. It seems the way in the article is a bit bothersome, but a better way for shared hosts that cannot set the document root.
This blog article also does the same way.
https://medium.com/@ayushbulbule/how-to-deploy-your-codeigniter-4-website-to-hostinger-cpanel-f66e84dfc45b

[kenjis]

It seems you can set the document root with cPanel, but the procedure is complicated:
https://support.cpanel.net/hc/en-us/articles/360055211213-How-to-change-the-document-root-of-the-primary-domain

It is simpler for Addon Domain or Subdomain:
https://support.cpanel.net/hc/en-us/articles/360057802373-How-can-I-change-the-document-root-for-an-Addon-Domain-or-Subdomain

[datamweb]

I upload the project in public_html.
Then I create a file public_html/.htaccess in the root of the project and fill it with the following code.

<IfModule mod_rewrite.c>
    RewriteEngine On
    RewriteRule ^(.*)$ public/$1 [L]
</IfModule>

<FilesMatch "^\.">
    Require all denied
    Satisfy All
</FilesMatch>

The project is now available via https://mydomain.com/ instead of https://mydomain.com/public/.

Exactly the same as in Adding .htaccess.

[kenjis]

That method is fine as long as Apache's .htaccess works fine.

However, it places files in the public area that do not need to be made public, and then adds rules to prevent access to certain files.

If we follow security principles, we should only place files in the public area that are likely to be accessed from the beginning.

This is because if there is a bug in Apache or if you accidentally modify .htaccess, files that should not be publicly accessible could be accessed.

That said, the method described in the forum, where the folder structure changes between the development (repository) folder structure and the production server folder structure, is also a bit complicated to deploy.

It is best if you can specify the document root as public in the server configuration.

[kenjis]

I sent another PR #8554 to add docs about Shared Hosting Services.

[kenjis]

Updated the description to add a link to another page.