Translations:Manual:Security/162/en

The exception being the images directory, which must be in the web root.