The web root folder is protected with he immutable attribute, so even root can not add subfolders without removing the attribute first. The festure is named folder protection and is configurable in server settings.
The name of the private folder us not onfigurable aet. But it might be. Good idea o add a option o configure the name.