The idea is this:
The webserver has a document-root. This is a directory where all the html and php pages are stored. You can access all those pages through a URL like www.server.com/path/to/file.php
so if you stored the passwords in a file inside the documentroot, I could access that file like this:
http://www.server.com/path/to/file/passwords.txt
So you want to move the passwords.txt to place where it can longer be accessed through a URL. That means that the file must be stored somewhere outside the webserver's documentroot. That way, it is nolonger a file that the webserver can server to clients, but PHP can still read it.
The easiest solution is to put the file in the same dir as the document-root is in:
ls /path/to
/path/to/document_root dir
/path/to/password.txt textfile