Where to put php files for security

Where to put php files for security

I am adding a php program file to my web site and put it in my bin
directory on a Windows Server. My ISP tech said the program wouldn't work
there because it is hidden from the public. So I put it in my root
directory and it worked. However, is it secure to put a php file in the
root directory of a server running Windows IIS? If not, how do I protect
it without having to remove the hidden security on my bin directory?