General good practice question about functions directory location

Most of my scripts are written for use on shared hosts. I've generally put my function and config files in a web-space directory. However, I been thinking it would be less bother to make stuff more secure if the functions, et al, were above the root directory. I realize, some hosts still don't let the owner use the space above the document_root. So, I'll provide a means so the directory can be installed under it. What's your opinion and practice?