Try Augment Code: a power tool for pro Laravel devs

Installing Laravel in a Subfolder? Hide your .env file.

Published on by

Installing Laravel in a Subfolder? Hide your .env file. image

If you are new to Laravel you might not be familiar with its directory structure and the reasons why it’s setup the way it is. If you look at the main repository it’s setup like this, and the documentation covers what each of these folders handles.

What is important here is the “public” folder. That is the ONLY directory you want to be exposed through the web. Everything else should be outside of your web root, this way people can’t access any of your important files through the browser.

As an example I found a site where they had a copy of Laravel installed on a domain like this:

site.com/subfolder/public/

Inside the “subfolder,” they left the original Laravel structure, so all you have to do is change the URL to site.com/subfolder/.env to see a lot of important data like the database connection. Not only this but the .git files as well that can expose other sensitive data.

If you have Laravel installed in a subfolder, please check that none of the dot files or the other directories are accessible through the browser, and if they are you can hide them by moving the out of the web root, or using .htaccess on Apache, or Nginx config. The best option is to move them above the web root and here is how you can setup Laravel in that situation.

Installing Laravel in a Subfolder

To install Laravel in a subfolder let’s walk through a typical server setup to demonstrate it. Typically the path to the web root is something like this, but it can vary depending on your host:

/var/www/html

With this path, the “html” folder is the web root, and your domain will typically point here. Now, let’s say you are building a blog and you create /var/www/html/blog. All the contents of your Laravel “public” folder would go in this folder. For example:

/var/www/html/blog/css/
/var/www/html/blog/js/
/var/www/html/blog/index.php

You will then put the rest of your Laravel folders and files in another place outside of “html”, for example:

/var/www/laravel/
/var/www/laravel/app/
/var/www/laravel/bootstrap/
/var/www/laravel/.env
/var/www/laravel/...

Then for the final steps modify your “blog/index.php” file and adjust the following two paths.

// blog/index.php change to point to /var/www/laravel/
 
require __DIR__.'/../bootstrap/autoload.php';
$app = require_once __DIR__.'/../bootstrap/app.php';

This will keep everything outside your web root, make your install more secure, and prevent unauthorized access to import items.

Eric L. Barnes photo

Eric is the creator of Laravel News and has been covering Laravel since 2012.

Cube

Laravel Newsletter

Join 40k+ other developers and never miss out on new tips, tutorials, and more.

image
CodeRabbit

CodeRabbit is an AI-powered code review tool that specializes in PHP and Laravel, running PHPStan and offering automated PR analysis, security checks, and more

Visit CodeRabbit
Curotec logo

Curotec

World class Laravel experts with GenAI dev skills. LATAM-based, embedded engineers that ship fast, communicate clearly, and elevate your product. No bloat, no BS.

Curotec
Bacancy logo

Bacancy

Supercharge your project with a seasoned Laravel developer with 4-6 years of experience for just $2500/month. Get 160 hours of dedicated expertise & a risk-free 15-day trial. Schedule a call now!

Bacancy
Laravel Forge logo

Laravel Forge

Easily create and manage your servers and deploy your Laravel applications in seconds.

Laravel Forge
Tinkerwell logo

Tinkerwell

The must-have code runner for Laravel developers. Tinker with AI, autocompletion and instant feedback on local and production environments.

Tinkerwell
NativePHP logo

NativePHP

Build rich mobile apps across iOS and Android from a single Laravel codebase. This changes everything!

NativePHP
Cut PHP Code Review Time & Bugs into Half with CodeRabbit logo

Cut PHP Code Review Time & Bugs into Half with CodeRabbit

CodeRabbit is an AI-powered code review tool that specializes in PHP and Laravel, running PHPStan and offering automated PR analysis, security checks, and custom review features while remaining free for open-source projects.

Cut PHP Code Review Time & Bugs into Half with CodeRabbit
Join the Mastering Laravel community logo

Join the Mastering Laravel community

Connect with experienced developers in a friendly, noise-free environment. Get insights, share ideas, and find support for your coding challenges. Join us today and elevate your Laravel skills!

Join the Mastering Laravel community
Kirschbaum logo

Kirschbaum

Providing innovation and stability to ensure your web application succeeds.

Kirschbaum
Shift logo

Shift

Running an old Laravel version? Instant, automated Laravel upgrades and code modernization to keep your applications fresh.

Shift
Lucky Media logo

Lucky Media

Get Lucky Now - the ideal choice for Laravel Development, with over a decade of experience!

Lucky Media
Lunar: Laravel E-Commerce logo

Lunar: Laravel E-Commerce

E-Commerce for Laravel. An open-source package that brings the power of modern headless e-commerce functionality to Laravel.

Lunar: Laravel E-Commerce
LaraJobs logo

LaraJobs

The official Laravel job board

LaraJobs
SaaSykit: Laravel SaaS Starter Kit logo

SaaSykit: Laravel SaaS Starter Kit

SaaSykit is a Multi-tenant Laravel SaaS Starter Kit that comes with all features required to run a modern SaaS. Payments, Beautiful Checkout, Admin Panel, User dashboard, Auth, Ready Components, Stats, Blog, Docs and more.

SaaSykit: Laravel SaaS Starter Kit

The latest

View all →
Manage Taxonomies, Categories, and Tags in Laravel image

Manage Taxonomies, Categories, and Tags in Laravel

Read article
Extract Arrays from Any Data Type with Laravel's Arr::from Method image

Extract Arrays from Any Data Type with Laravel's Arr::from Method

Read article
Better defaults for your Laravel applications with Essentials image

Better defaults for your Laravel applications with Essentials

Read article
Repeat Strings Efficiently with Laravel's Str::repeat Method image

Repeat Strings Efficiently with Laravel's Str::repeat Method

Read article
Encrypt and Decrypt String Helpers in Laravel 12.18 image

Encrypt and Decrypt String Helpers in Laravel 12.18

Read article
Keep Your Place: Enhancing User Experience with Fragment Method image

Keep Your Place: Enhancing User Experience with Fragment Method

Read article