Calling php file from javascript using jQuery.get(), location of php? -

before closing duplicate, please know read many similar questions on , none of them answers doubt.

i trying call .php file using jquery.get()

$.ajax({  url: url, data: data, success: success, datatype: datatype }); 

i using wordpress , javascript code trying call php file included in page's header.

i put php file in my-includes folder in root of server, can access using url:/my-includes/xxx.php . (thanks go osdm answer)

but publically accessible using domain-name/my-includes/xxx.php

my question is-

1. is how websites work. isn't security risk?

2. can make file inaccessible general public yet keep working site?

if make url this: url: '/folderintheroot/file.php' start root of website no matter url is. key here is: '/' @ beginning.

regarding security issues. if people can visit website, means can see send server computer. when script called jquery.get() same. whatever public, public. else have start working login , password, whole other story.

there 1 thing can though, see here: using .htaccess, prevent users accessing resource directories, , yet allow sourcecode access resources