when entering the domain mywebsite.com the folder mywebsite.com is root for that domain. Php files can be placed outside of that root as they are accessed server side. css however is accessed by the end users browser, which can not read anything outside of the root folder for that domain.