My members directory is in my cgi-bin, and that is above the web root like recommended.