If you’re running Apache, you can put a .htaccess file in your templates/ folder with this in it:
Deny from all
and any HTTP traffic to that folder will be given an Apache 403 error.
Even better, you can put this in there:
# Send the request to Craft RewriteEngine On RewriteRule (.*) /index.php?p=$1 [QSA,L]
and the request will be redirected to Craft’s index.php file behind the scenes, the same way that would-be 404s are sent there. So even if you go to /templates/index.html, or any other URL that points to an actual file within your templates/ folder, it will end up as /index.php?p=templates/index.html, leaving Craft to handle the request, which will most likely result in a Craft-based 404.
It depends on what kind of secure infos you write into your templates. I wouldn't put my credit card infos into a twig comment for example, if the template is not above the root.
But normally all one could make up from the raw template code is rather uninteresting and not really relevant for further hacking attempts, I'd say.
Note: please do NOT put the
craft/config/ folder above the root!