For extra security, I move my Joomla config file out of /public_html and call it joomla.conf, and then I edit /public_html/configuration.php as follows;

<?php
require("/home/mysite/joomla.conf");
?>

This is apparently incompatible with the captcha plugin. It won't render the image, and instead gives an error about cb.session.php not being able to connect to the database (because it can't find the database username/password etc.

Seems to me this should work even with my method, but it doesn't. For now I have reverted back to the typical setup for config files.