Comment by citricsquid

Quick feedback: Don't commit vendor packages to your repository, make use of Composer (http://getcomposer.org). Separate out your application core from the public folder, that way you don't need to rely on your web server for security: if someone uses nginx your set up leaves them vulnerable. Look into MVC, you have logic and display mixed together.