Ajax pages

Could they be put in a folder that is inaccessible to site visitors?
I keep my php includes in a folder denied by htaccess. My php cron job scripts are in a folder outside of the public root.
Would your scripts still work if they were in a non-public folder?