Installing Laravel in a Subfolder? Hide your .env file.

Published on by

Installing Laravel in a Subfolder? Hide your .env file. image

If you are new to Laravel you might not be familiar with its directory structure and the reasons why it’s setup the way it is. If you look at the main repository it’s setup like this, and the documentation covers what each of these folders handles.

What is important here is the “public” folder. That is the ONLY directory you want to be exposed through the web. Everything else should be outside of your web root, this way people can’t access any of your important files through the browser.

As an example I found a site where they had a copy of Laravel installed on a domain like this:

site.com/subfolder/public/

Inside the “subfolder,” they left the original Laravel structure, so all you have to do is change the URL to site.com/subfolder/.env to see a lot of important data like the database connection. Not only this but the .git files as well that can expose other sensitive data.

If you have Laravel installed in a subfolder, please check that none of the dot files or the other directories are accessible through the browser, and if they are you can hide them by moving the out of the web root, or using .htaccess on Apache, or Nginx config. The best option is to move them above the web root and here is how you can setup Laravel in that situation.

Installing Laravel in a Subfolder

To install Laravel in a subfolder let’s walk through a typical server setup to demonstrate it. Typically the path to the web root is something like this, but it can vary depending on your host:

/var/www/html

With this path, the “html” folder is the web root, and your domain will typically point here. Now, let’s say you are building a blog and you create /var/www/html/blog. All the contents of your Laravel “public” folder would go in this folder. For example:

/var/www/html/blog/css/
/var/www/html/blog/js/
/var/www/html/blog/index.php

You will then put the rest of your Laravel folders and files in another place outside of “html”, for example:

/var/www/laravel/
/var/www/laravel/app/
/var/www/laravel/bootstrap/
/var/www/laravel/.env
/var/www/laravel/...

Then for the final steps modify your “blog/index.php” file and adjust the following two paths.

// blog/index.php change to point to /var/www/laravel/
 
require __DIR__.'/../bootstrap/autoload.php';
$app = require_once __DIR__.'/../bootstrap/app.php';

This will keep everything outside your web root, make your install more secure, and prevent unauthorized access to import items.

Eric L. Barnes photo

Eric is the creator of Laravel News and has been covering Laravel since 2012.

Cube

Laravel Newsletter

Join 40k+ other developers and never miss out on new tips, tutorials, and more.

image
Laravel Forge

Easily create and manage your servers and deploy your Laravel applications in seconds.

Visit Laravel Forge
Laravel Forge logo

Laravel Forge

Easily create and manage your servers and deploy your Laravel applications in seconds.

Laravel Forge
Tinkerwell logo

Tinkerwell

The must-have code runner for Laravel developers. Tinker with AI, autocompletion and instant feedback on local and production environments.

Tinkerwell
No Compromises logo

No Compromises

Joel and Aaron, the two seasoned devs from the No Compromises podcast, are now available to hire for your Laravel project. ⬧ Flat rate of $7500/mo. ⬧ No lengthy sales process. ⬧ No contracts. ⬧ 100% money back guarantee.

No Compromises
Kirschbaum logo

Kirschbaum

Providing innovation and stability to ensure your web application succeeds.

Kirschbaum
Shift logo

Shift

Running an old Laravel version? Instant, automated Laravel upgrades and code modernization to keep your applications fresh.

Shift
LoadForge logo

LoadForge

Easy, affordable load testing and stress tests for websites, APIs and databases.

LoadForge
Paragraph logo

Paragraph

Manage your Laravel app as if it was a CMS – edit any text on any page or in any email without touching Blade or language files.

Paragraph
Lucky Media logo

Lucky Media

Bespoke software solutions built for your business. We ♥ Laravel

Lucky Media
Lunar: Laravel E-Commerce logo

Lunar: Laravel E-Commerce

E-Commerce for Laravel. An open-source package that brings the power of modern headless e-commerce functionality to Laravel.

Lunar: Laravel E-Commerce
Bacancy - Staff Augmentation logo

Bacancy - Staff Augmentation

Leave your web app development hustles to the leading IT Staff Augmentation Service Providers. Choose from an extensive pool of 1050+ developers and give yourself the sigh of success you deserve with Bacancy. Get In Touch Today!

Bacancy - Staff Augmentation
DocuWriter.ai logo

DocuWriter.ai

Save hours of manually writing Code Documentation, Comments & DocBlocks, Test suites and Refactoring.

DocuWriter.ai
Rector logo

Rector

Your partner for seamless Laravel upgrades, cutting costs, and accelerating innovation for successful companies

Rector

The latest

View all →
Laracon EU Videos are now out image

Laracon EU Videos are now out

Read article
Use Google's Gemini AI in Laravel image

Use Google's Gemini AI in Laravel

Read article
PhpStorm is getting a brand new terminal image

PhpStorm is getting a brand new terminal

Read article
Six Essential Plugins for Visual Studio Code image

Six Essential Plugins for Visual Studio Code

Read article
Modularize Your Laravel Application With the Modular Package image

Modularize Your Laravel Application With the Modular Package

Read article
Handle Money Transactions in Eloquent with Laravel Wallet image

Handle Money Transactions in Eloquent with Laravel Wallet

Read article