I have all of my database credentials within an include file that I wanted to place outside of my webroot file.

However, my shared hosting plan does not allow me to place files outside of the webroot. Would I have to look at encrypting my file in some way to make sure my credentials are secure?

I had read a method to produce a kind of fake 404 page, but that doesnt sound very secure to me at all.

I've also taken the step of creating a read-only user account so that if my account is compromised then at least nothing can be overwritten or dropped, but I obviously want to be as secure as I can given the limitations.