My wordpress installs all have a custom directory structure. Core WP files are in /wp and a separate directory contains the plugins, themes and uploads folders.

My wordpress installs all have a custom directory structure. Core WP files are in /wp and a separate directory contains the plugins, themes and uploads folders. You can configure WP to do this, and Roots Bedrock does this for you. Not really a security feature, though. But it is nice to not have your plugins and themes in a subdirectory of WP since bedrock updates plugins and wp via composer.